Prioritize fixes when everything looks critical

When everything looks critical, nothing gets fixed on time.

We propose a simple framework to order remediation by exposure, exploitability, and business impact.