The exempted system is the one attackers find and the one that voids the policy. The exemption register is now a financial document.
An ideological name requires no capability and no conviction. It buys coverage, and it redirects attention toward a motive that may not exist.
Four accidents in 454 files is not coverage of a population reportedly targeted by 43% of attacks.
Where a sector has four participants, two incidents approach population-scale coverage.
Correctly patched, correctly configured, reporting green, and serving an attacker. Patch coverage cannot see the difference.
An affiliate panel records who was attacked because the operation needed to track it. No notification law stands between the event and the row.
The gap was not a judgement about relative importance. Nobody made a judgement at all.
A small municipal utility has the operational exposure of critical infrastructure and the budget of a town department — and no route into the record.