Exploit Code Maturity This metric measures the likelihood of the vulnerability being attacked, and is typically based on the current state of exploit techniques, exploit code availability, or active, 'in-the-wild' exploitation. Unproven No exploit code is available, or an exploit is theoretical.