Question

A security analyst is preparing the monthly vulnerability management report for the IT operations team, whose job is to schedule and execute remediation work. The CISO has separately requested a report tailored to executive leadership. Which metric is MOST appropriate to emphasize in the report going to the IT operations team specifically?

Accepted Answer

The number of affected hosts per unpatched CVE, grouped by system owner and patch deadline

Answer

The overall organizational risk posture expressed as a single color-coded rating

Answer

The estimated financial impact of a breach affecting the vulnerable systems

Answer

A high-level comparison of the company's risk against industry peers