Question

A security manager compiles quarterly vulnerability scan results to present to leadership. Over the past year the raw count of open critical vulnerabilities has risen from 40 to 65, but during the same period the organization deployed 300 new servers as part of a cloud migration. Leadership wants to understand whether the security posture is actually deteriorating. What should the manager do to produce the most meaningful analysis of the test output?

Accepted Answer

Normalize the vulnerability counts against the number of assets to compare defect density trends over time

Answer

Report the absolute increase in critical vulnerabilities and recommend an emergency remediation budget

Answer

Replace the authenticated scans with unauthenticated scans to reduce the reported vulnerability count

Answer

Exclude the newly migrated cloud servers from the report until they have completed a full patch cycle