Hundreds of vulnerabilities are reported across devices. Which remediation order best reduces operational security risk?

1. Patch only devices with the shortest names
2. Prioritize exposure, exploit activity, asset value, and available mitigations
3. Defer all remediation until every finding is confirmed exploited
4. Use severity alone regardless of exposure and business role