Microsoft explains how it decides whether a vulnerability will be patched swiftly or left for a version update.