Option 4 would be internal discovery / knowledge of a new vulnerability with a perceived need for immediate patching. We're on week 3 or 4 of every IT department across the country having to patch pretty significant newly announced vulnerabilities across many systems. It's not unreasonable to think that there are vulnerabilities that the government has advance knowledge about that they're quietly patching in their systems before the vulnerabilities go public.