A penetration test report rates a finding as Critical (CVSS 9.8) for an unauthenticated RCE vulnerability in the client's VPN appliance. The client's security manager argues the risk is 'Low' because 'we've never been hacked before.' How should the penetration tester respond?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to keep the Critical rating because an unauthenticated RCE on an internet-facing VPN appliance is objectively maximum severity. Offer a controlled demonstration or threat intelligence to back the finding with evidence.
Full Explanation
The correct response is to maintain the Critical rating with technical justification: CVSS scoring reflects exploitability and impact, and an unauthenticated, network-exploitable remote code execution vulnerability on a VPN appliance is maximum severity. A penetration tester must provide accurate risk assessments based on technical evidence, not client preference. Offering a controlled demonstration or threat intelligence provides objective evidence. Agreeing and downgrading the finding to Low to maintain the client relationship is wrong because adjusting severity to satisfy a client compromises assessment integrity. Removing the finding to avoid conflict is wrong because omitting findings constitutes professional misconduct. Changing severity to Medium as a compromise is wrong because arbitrary severity changes without technical justification undermine the assessment.