How to Balance Security Concerns With Fatigue

In security, it's always about having a lot of issues and understanding what you need to prioritize. So on this metrics, you might find yourself things are low probability and low impact. Probably you'll get to them last. If you've got high probability, high impact, those categories will go first. Another question is how do you distinguish between all the issues?