CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A security analyst is reviewing a vulnerability scan report for a new internal application. The report indicates several critical vulnerabilities. The development team, however, argues that these findings are not exploitable in the current production environment due to compensating controls and network segmentation. Which of the following metrics would BEST highlight the actual risk posture to executive leadership?
- APercentage of critical vulnerabilities with confirmed exploitability
- BNumber of critical vulnerabilities identified
- CTotal number of vulnerabilities across all severities
- DMean time to remediate (MTTR) for critical vulnerabilities
Show answer & explanationAnswer & explanation
Correct answer: A. Percentage of critical vulnerabilities with confirmed exploitability
Executive leadership needs to understand the actual, rather than theoretical, risk. The number of critical vulnerabilities identified might be high, but if many are not exploitable, it misrepresents the true risk. Focusing on confirmed exploitability provides a more accurate picture of the immediate threat.
Why the other options are wrong
- B. This metric can be misleading if many identified vulnerabilities are not actually exploitable in the specific environment.
- C. This metric provides a broad overview but lacks the specificity required to address the development team's concerns about exploitability or inform executive decisions on critical risks.
- D. While important for operational efficiency, MTTR doesn't directly address the initial exploitability dispute or the current risk posture.
Exploitability Metric
A metric that quantifies the proportion of identified vulnerabilities that are confirmed to be exploitable within a given operational environment, providing a more accurate assessment of actual risk.
- Focuses on actual risk, not theoretical.
- Accounts for compensating controls and environmental factors.
- Useful for executive reporting to avoid alarm over non-issues.
Memory trick: Executives need 'Actual Risk' not just 'Raw Count'.