Take a CVSS vulnerability score apart and turn it into likelyhood and consequence for your specific environment.
That is the only correct way of looking at vulnerabilities.
I hope this session was usefull, and that it helps apply to your environment.
Here you can find the recording and download the presentation.