Asset criticality

The same flaw is urgent on one system and unimportant on another, and the difference is what the system does.

A critical vulnerability on a decommissioned test server is not a crisis. A moderate one on the machine handling payments might be. Prioritisation without knowing which systems matter is arithmetic on the wrong inputs, and most organisations find that establishing criticality is harder than finding the vulnerabilities.