We can patch anything — how do we pick what to fix first?

You can find vulnerabilities all day. That is not your problem. Your problem is that the list grows faster than you can work it, and your team keeps arguing about what matters most. Every week looks urgent. Every item has a defender. Here is what you are avoiding: there is no ranking that will feel safe. You want certainty before you choose. It will not come. While you wait for a perfect order, you are already choosing — you are choosing to fix nothing, together, in a very organized way. Your team does not need more data. It needs an agreement: a short, shared rule for what goes first, made once, used every time. Then the discipline to stop re-opening that argument each time something new appears.