Triage CVE advisories with a bar per severity

Your security team gets about 300 CVE advisories a week (public reports of a security flaw in some piece of software), and most do not affect your stack. Missing one critical is far worse than 100 false alarms, so each severity gets its own rule.

Write triage_cve_advisories(severities, match_confidences, internet_exposed): the rule your agent follows for each advisory.

• severities (list of str): each advisory's severity: "low", "medium", "high" or "critical", in any case.
• match_confidences (list of int): how sure the agent is, from 0 to 100, that the advisory matches software you run. Treat a value below 0 as 0 and one above 100 as 100.
• internet_exposed (list of bool): whether the affected service can be reached from the internet.
• The 3 lists have the same length, and index i is one advisory. Return one decision per advisory, in order: "escalate", "human_review" or "dismiss".

With c the confidence after that clamp, by severity:

• low: "escalate" if the service is exposed and c is at least 80. Otherwise "dismiss".
• medium: "escalate" if c is at least 70, or if c is at least 50 and the service is exposed. Otherwise "dismiss" if c is below 20 and the service is not exposed. Otherwise "human_review".
• high: "escalate" if c is at least 40, or if c is at least 20 and the service is exposed. Otherwise "human_review".
• critical, and any severity not listed above: "escalate" if c is at least 20 or the service is exposed. Otherwise "human_review".

Then, in a sentence or two: why not one confidence bar for every severity?