NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
France's official attribution of the attacks on supermarket cooling systems to the IRGC shows that state actors deliberately exploit exposed OT/IoT devices of European organizations as an entry point.