i worked in fraud analytics and the consensus was that fraudulent activity weighted higher from certain networks than from others. i wasn't in the position to question the decision regarding threats where i was, i just implemented the risk level rating in software.