Observed behaviour doesn't fall within accepted range Vulnerability potential None DDoS potential None Real behaviour doesn’t match expectation