Delete comment from: Google Online Security Blog
I believe it should be at a macro level by determining how many users will be affected by same pattern etc.. (using complex methods like geography, type of users, area of attack and so on..)
regards
www.diaryfolio.com
Jun 6, 2012, 8:30:48 AM
Posted to Security warnings for suspected state-sponsored attacks