For the CISO, the first task is to identify what is only innocent smoke from what is actually a fire. By combining tools like threat intelligence, vulnerability research, and probability risk, CISOs can begin to prioritize.