Best risk based vulnerability management solution? tired of guessing.

Six months ago our backlog hit 38k open findings across three business units and I finally admitted CVSS-sorting was actively making things worse, not just inefficient. We had analysts spending entire mornings triaging "critical" findings that turned out to be on decommissioned test boxes, while a 6.8 sitting on a customer-facing app with active exploitation sat untouched for two weeks because nobody flagged it.

What fixed it wasn't a new scanner. It was rebuilding our scoring to weight business criticality and exposure status alongside severity, plus pulling in exploit context (KEV, EPSS) so "critical" actually meant something. Backlog didn't shrink overnight, but the team stopped burning cycles on noise within about a month. Still tuning the weighting though, anyone landed on a good formula for balancing asset criticality vs. threat data without one drowning out the other?