Predicting the Difficulty of Compromise through How Attackers Discover Vulnerabilities