Try the following: Categorize all your assets based on function and criticality to the business.
Tackle remediation based the above
Separate application vulns from OS
Work with asset owners (OS and Application Owners) - get their buy in - they do the work so they have to…