How is attacking a vulnerability categorized?