Question

A CySA+ analyst is designing a monthly vulnerability management dashboard for the CISO. The CISO wants a metric that specifically signals when the organization's exposure is trending toward exceeding its defined risk appetite, rather than just measuring how efficiently the security team is operating. Which metric should the analyst designate for this purpose?

Accepted Answer

The percentage of critical vulnerabilities on internet-facing assets that remain unremediated past their SLA deadline

Answer

The average number of vulnerabilities remediated per analyst each week

Answer

The number of scans completed on schedule during the reporting period

Answer

The total count of vulnerabilities identified across all asset classes this month