George's firm contracts to provide risk management services for a wide range of smaller companies that cannot provide the service for themselves. One of George's responsibilities at the end of each month is to review the threats encountered by the companies and put them into the appropriate categories.​ Another of George's clients has software that is outdated and has become increasingly vulnerable to attack. How does George categorize this threat?