Question

A quarterly automated vulnerability scan of a retail company's e-commerce platform returns 480 findings, including 62 rated 'Critical.' Before these are entered into the risk register and escalated, the risk analyst notices the scan was run against a staging environment that uses default credentials and unpatched libraries not present in production. What should the risk analyst do FIRST to ensure the accuracy of the vulnerability analysis?

Accepted Answer

Validate and contextualize the scan results against the production environment to eliminate false positives before analysis

Answer

Enter all 62 Critical findings into the risk register immediately to avoid delaying remediation

Answer

Reduce the severity rating of all findings by one level to account for staging-only exposure

Answer

Discard the entire scan and reschedule it exclusively against the production environment