Calculating urgency

I'm curious how you calculate Urgency, not from a GRC standpoint, but from a blue team perspective.
For example, when determining urgency for a lack of visibility (we do not have DNS query logs / audit logs from our hypervisor, we do not have entries for network devices in DNS for quick identification) because you do not yet have "proof" that something is happening, you are working with Fear, Uncertainty, and Death as a means of convincing others to get …

audit blue blue team blueteamsec devices dns grc hypervisor identification logs network network devices perspective query team visibility