In this research, we identify common persistent vulnerabilities, highlighting exploitable ones and assessing their characteristics. We also draw out lessons about vulnerabilities and their attributes, and how they may influence remediation processes. However, the results of our research indicate that the traditional methods prioritization are insufficient to reduce risk. This is not necessarily a fault of the organizations using these methods; they are making do in the absence of better resources.