Use when deciding which indicators to prioritise — a model for valuing intelligence by how much it costs the attacker to change, so you invest in detections that actually hurt them.
