If you were given a system with known vulnerabilities, how would you prioritize them for remediation?