Smart Prioritization

CISA SSVC decision model — what to fix first, beyond raw CVSS