CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A security analyst is compiling a vulnerability report for the executive leadership team. The report identifies a critical vulnerability (CVSS v3.1 score: 9.8) in a public-facing web application. To effectively communicate the business impact and urgency, which of the following metrics or statements should the analyst prioritize including?
- AThe potential financial loss and reputational damage if the vulnerability is exploited.
- BThe current Mean Time To Patch (MTTP) for critical vulnerabilities across the organization.
- CA list of all servers running the vulnerable software version, including their IP addresses.
- DA detailed technical explanation of the vulnerability's exploit mechanism and affected CVEs.
Show answer & explanationAnswer & explanation
Correct answer: A. The potential financial loss and reputational damage if the vulnerability is exploited.
Executive leadership is primarily concerned with business impact, risk, and financial implications. Communicating the potential financial loss and reputational damage directly translates the technical vulnerability into terms relevant to their decision-making, emphasizing urgency and justifying resource allocation for remediation. Technical details (A) or internal process metrics (B, D) are less impactful for this audience.
Why the other options are wrong
- B. While a useful internal metric, it doesn't convey the direct business impact of this specific critical vulnerability to executives.
- C. This is operational detail for technical teams, not relevant for executive leadership's strategic decision-making.
- D. This is too technical for executive leadership; they need the 'so what' for the business.
Executive Vulnerability Reporting
Communicating vulnerability risks to executive leadership, focusing on business impact, financial implications, and strategic risks.
- Translate technical risks into business terms.
- Emphasize potential financial loss, reputational damage, and regulatory non-compliance.
- Provide actionable recommendations at a high level.
Memory trick: Executives care about MONEY and NEWS headlines, not code.