Why is it so hard to prioritize potential vulnerabilities? And what can we do about it? Let’s take a closer look.