After a new detection tool was deployed, the number of reported security incidents tripled compared with the previous quarter. The information security manager is preparing the quarterly report for senior management. What is the BEST way to present this metric?
Select an answer to reveal the explanation.
Short Explanation
A number without a story is a rumor waiting to happen. Triple the incidents looks scary until you explain that you just turned on better lights and can finally see what was already in the room. Give the trend, the reason, and what you're doing about it; hiding it or spinning it both cost you credibility.
Full Explanation
Metrics inform decisions only when the audience understands what drives them. A sharp rise in recorded incidents after a detection tool is deployed usually reflects improved visibility rather than more attacks, so the report should present the trend, explain the cause, describe the impact on business risk and set out the actions being taken. This lets senior management interpret the figure correctly and judge whether the program is working. Reporting the raw count with no commentary invites misinterpretation, and management may conclude that security has collapsed. Leaving the metric out breaks the trend and conceals information that management is entitled to see, damaging trust when the omission is noticed. Presenting the rise as a deterioration misstates what the data shows, and requesting funding on that basis would rest a business case on a misleading interpretation. Exam caveat: the explanation must be supported; if analysis shows genuine growth in attacks alongside better detection, the report should say so. Operational check: break the incidents down by detection source and severity, compare the categories the old tools could see with the new ones, and state whether impact-weighted incidents rose or fell.