Identification should include how IP services are exploited by threat actors.