Question

A security analyst must present the quarterly vulnerability management program status to the company's board of directors. The board has no technical background and wants to understand whether the organization's risk posture is improving. Which approach BEST communicates findings to this audience?

Accepted Answer

Present a trend chart showing the reduction in critical and high-risk vulnerabilities over time alongside SLA compliance percentages, framed in terms of business risk

Answer

Distribute the raw vulnerability scanner export with all CVE identifiers and CVSS vector strings for each affected host

Answer

Walk through the top 20 individual plugin findings and explain the technical remediation steps for each one

Answer

Provide a packet capture summary and MITRE ATT&CK technique mappings for the most recently exploited vulnerabilities