Question

A CySA+ analyst compiles a monthly vulnerability report comparing two business units. Unit A shows 320 open critical vulnerabilities and Unit B shows 45. Leadership is preparing to reprimand Unit A's manager for poor security posture. However, the analyst knows Unit A manages 4,000 hosts while Unit B manages 200. Before the report is distributed, what should the analyst do to ensure the metric fairly represents each unit's risk posture?

Accepted Answer

Normalize the findings as vulnerability density (e.g., critical vulnerabilities per host) so the comparison accounts for differing environment sizes

Answer

Report only the raw counts, since absolute numbers of critical vulnerabilities are the most objective measure of exposure

Answer

Remove Unit B from the report entirely because its small size makes any comparison statistically meaningless

Answer

Combine both units into a single organization-wide total to avoid singling out any individual manager