Vulnerability prioritization with a risk matrix