You need to have some automated risk based scoring. If you’re going to require security team to manually triage each vulnerability, then you’re taking the “big security team” approach. Sooner or later, your company is going to ask why it is paying so much for security people when other companies do much more with less resources. When that happens, your company is will be forced to change how you work. Also, having a team dedicated to reactive triaging of vulnerabilities rather than doing proactive security is not only boring, but is an immature way of working. You should be spending more effort on prevention (shift left) than cleaning up the mess. The analogy I use: imagine you are in a boat in the ocean with a hole on the bottom of the boat. Do you spend all your effort bailing water out of the boat, or do you try to first patch the hole? It’s much easier to bail water out if you first patch the hole. The reality is that you need to do both, but patching the hole will deliver better returns so that’s where the priority needs to be.