A vulnerability exists, but the only proposed attack requires access that no credible threat actor can currently obtain. What should the practitioner assess?

1. The feasibility of the threat path and conditions that could change it
2. Treat the vulnerability as impossible forever
3. Assume every theoretical path is currently equally likely
4. Use impact alone as the entire risk estimate