Comment by TeMPOraL

Yes. But we usually start with a high default, and only recalibrate if there's a specific reason in a given situation (e.g. there's been a specific user or sets of users involved in spreading malware, and software in question could've been targeted).