A team discovers unauthorized access that has already occurred. How should it distinguish the event from prospective risk?

1. Delete every related future risk because the event happened once
2. Keep it only as a hypothetical risk indefinitely
3. Treat the realized event as an issue or incident while assessing continuing and future exposure
4. Assume the incident proves every scenario certain