Use the Scope metric carefully. If an exploit impacts a component beyond its security boundary (e.g., a sandbox escape), set Scope to Changed.