Refactor risk calibration to capture attacker privileges and user interaction.