How do automated vulnerability assessment tools prioritize discovered security risks so development teams know which patches to apply first?