You administer a GitHub Enterprise Cloud organization with hundreds of repositories. The security team complains that Dependabot alerts are overwhelming: developers are inundated with low-severity notifications and are ignoring the truly critical ones. Leadership wants a way to focus response effort on the highest-risk vulnerabilities across the organization without disabling Dependabot alerts entirely. Which approach best meets this requirement?