# 🏥 Prioritizing Patches

You have 10,000 vulnerabilities. You can patch 50. Which ones?

## 📝 The Scenario
1. **Server A**: Internal Test Server. Vulnerability: Score 10.0 (RCE).
2. **Server B**: External Web Server. Vulnerability: Score 7.5 (SQLi).

## 🕵️‍♂️ Decision Steps

### Step 1: Exposure
* **Server B** is reachable from the internet. Attackers are scanning it 24/7.
* **Server A** is behind a firewall. Attackers need to be inside first.

### Step 2: Exploitability
* Is there a Metasploit module for the SQLi? Yes.
* Is the RCE theoretical? Yes.

### Step 3: Business Impact
* If Web Server goes down, we lose money.
* If Test Server goes down, devs preserve coffee.

### 🏆 Verdict
**Patch Server B first**. Context matters more than raw score.
