Stop patching by score – and start patching by authority

When we understand the authority an exploit gives a threat actor and what it lets them do next, we understand why “patch now” makes sense.