A city VA report lists hundreds of low-severity findings and buries one critical default credential on an internet-facing admin portal. How should prioritization work?
Select an answer to reveal the explanation.
Short Explanation
A pile of paper cuts does not outrank an unlocked front door. Fix what an attacker would actually use first—like that default admin password—then grind through the noise.
Full Explanation
Effective vulnerability prioritization weighs likelihood and business impact, not raw finding volume. A critical default credential on an exposed portal typically outranks hundreds of low informational issues. Averaging scores or hiding the critical item until retest misguides remediation owners.