  Vulnerability exploitation is reportedly one of the main attack vectors
against computer systems. Yet, most vulnerabilities remain unexploited by
attackers. It is therefore of central importance to identify vulnerabilities
that carry a high `potential for attack'. In this paper we rely on Symantec
data on real attacks detected in the wild to identify a trade-off in the Impact
and Complexity of a vulnerability, in terms of attacks that it generates;
exploiting this effect, we devise a readily computable estimator of the
vulnerability's Attack Potential that reliably estimates the expected volume of
attacks against the vulnerability. We evaluate our estimator performance
against standard patching policies by measuring foiled attacks and demanded
workload expressed as the number of vulnerabilities entailed to patch. We show
that our estimator significantly improves over standard patching policies by
ruling out low-risk vulnerabilities, while maintaining invariant levels of
coverage against attacks in the wild. Our estimator can be used as a first aid
for vulnerability prioritisation to focus assessment efforts on high-potential
vulnerabilities.
