What is meant by exposure factor ( ef)?

a. the probability that a particular threat will exploit an it vulnerability causing harm to an organization.
b. this is measured in terms of probability and consequence.
c. the expected amount of damage that an asset would incur if a risk materialized; normally described as a percentage.
d. the number of times per year you expect a compromise to occur.
e. a potential attack on a system.