Is your organization able to rank vulnerabilities based on exploitability and potential impact? If so, how automated is the process?