The information security manager must report to senior management whether the vulnerability management process is effective at reducing exposure. Which metric BEST demonstrates this?
Select an answer to reveal the explanation.
Short Explanation
Counting how many times you checked the oil doesn't tell you whether the engine's healthy. Effectiveness means critical problems on important systems are getting fixed fast enough. Watch out for activity counts that just show the team is busy.
Full Explanation
An effectiveness metric must show whether a process achieves its purpose, and the purpose of vulnerability management is to reduce exposure on the assets that matter. Mean time to remediate critical vulnerabilities on business-critical systems, compared with an agreed target, shows directly whether the riskiest weaknesses are being closed quickly enough and whether performance is improving. It is meaningful to senior management because it ties to business-critical assets and to an expectation they can hold someone accountable for. The number of scans completed measures activity; frequent scanning with no remediation reduces nothing. A raw total of vulnerabilities detected is ambiguous, since it rises with better coverage and falls with gaps in scanning, and it lacks context about asset importance or severity. The percentage of systems with a licensed scanner measures tool coverage, which is a prerequisite for the process rather than evidence that exposure is falling. Exam caveat: coverage metrics can be useful supporting indicators, but they should not be presented as proof of effectiveness. Operational check: confirm the metric is calculated from remediation timestamps in the ticketing system, segmented by asset criticality, and reported against a target that management has approved.