Scanning is the most common first step for prioritizing vulnerabilities for remediation. However, scans often turn up far more vulnerabilities than a security team can address. The standard Common Vulnerability Scoring System is a good starting point for prioritization. This system typically scores results, accounting for the type of attack, complexity, and level of access. Additionally, prioritization must also take exploitability and business impact into account. Often, the CVSS score on its own does not help prioritize as it is designed to score the worst-case scenario and assumes the vulnerability is exploitable.