Turn a vulnerability scan into a prioritized fix plan

Help me turn vulnerability scan results into a prioritized remediation plan. Scan export: [PASTE findings: CVE or plugin, CVSS, host, OS or software, first seen] Asset context: [which hosts are internet-facing, hold sensitive data, or are business-critical] Known exploited or EPSS data: [PASTE if I have it - otherwise "none"] Compensating controls: [e.g. "behind VPN", "EDR on all endpoints", "WAF in front of web apps"] Our remediation SLAs: [e.g. "critical 7 days, high 30 days" - or "suggest some"] Team capacity: [people and hours per week available] Prioritize using these factors, in order: actively exploited in the wild (if I provided that data), exposure (internet-facing first), asset criticality, exploit complexity, then CVSS. Explain any case where you rank something above a higher CVSS score. Then: 1. Group findings that one fix resolves (a single patch, upgrade, or config change across many hosts). 2. Flag likely false positives or findings that need verification (e.g. backported patches). 3. Identify items that cannot be patched soon and suggest compensating controls or a documented risk acceptance. Return: - A remediation table: Priority | Fix action | Findings covered | Hosts | Owner [ADD] | Due date | Notes. - The top 5 actions for this week. - A 3-sentence summary for my manager. Do not invent exploit status or CVE details I did not provide; mark them [VERIFY].