A vulnerability backlog is large. Which prioritization method is best?

1. Remediate only the weaknesses with the shortest estimated fix time
2. Use severity scores alone in every case
3. Prioritize systems by the size of their annual maintenance invoice
4. Combine exploitability, exposure, business impact, and existing controls