Question

A penetration tester merges vulnerability scan results from three subnets and receives 4,200 individual findings. Analysis shows that 3,100 of them are variations of 'Missing security patch' reported per-host, and most trace back to a single unpatched base image used across the environment. The tester must present actionable results to a client with a limited remediation window. What is the MOST effective way to analyze and prioritize these findings for the report?

Accepted Answer

Group the patch findings by common root cause (the shared base image) and prioritize remediation of the image, then note affected host counts

Answer

Report all 4,200 findings individually so the client has a complete inventory of every vulnerable instance

Answer

Filter out all 3,100 patch findings as likely false positives since a shared base image cannot produce that many real issues

Answer

Sort strictly by raw CVSS base score and address the highest-numbered CVEs first regardless of how they were introduced