Question

A security analyst has been asked to present the results of the quarterly vulnerability management program to the company's board of directors. The analyst's draft slide deck currently includes detailed CVE identifiers, individual CVSS vector strings, per-host scan output, and a list of specific patch KB numbers. The board's primary concern is understanding whether the organization's risk exposure is improving over time and whether the security budget is being spent effectively. What is the MOST appropriate change the analyst should make to the report before presenting to this audience?

Accepted Answer

Replace the technical detail with trend-based risk metrics, such as reduction in open critical findings over time, SLA compliance percentages, and risk exposure relative to peers.

Answer

Add more CVE detail and raw scanner output so the board can independently verify the accuracy of the findings.

Answer

Remove all metrics entirely and present only a narrative summary of recent incidents the team responded to.

Answer

Keep the CVSS vector strings but add a glossary explaining each metric component so board members can interpret the scores themselves.