Two findings affect different systems: a high-score flaw on an isolated lab host and an actively exploited flaw on an internet-facing payment server. What should drive prioritization?

1. Ignore the payment server because it is currently online
2. Always patch whichever hostname sorts first
3. Always sort only by the base score
4. Combine exploit activity, exposure, business impact, and technical severity