When calculating the risk associated with a vulnerability being exploited, how is this risk calculated?