An organization reviews a recommendations report after a successful PenTest exercise. The cost to mitigate the issue is costly. Which group is the report generated for?

• A. IT Operations
• B. End Users
• C. C-Suite
• D. Development Team

Answer: (C)

Executive leadership is the primary audience for a recommendations report after a pentest when mitigation costs are significant. The report translates technical findings into business terms—highlighting the risk exposure, potential impact on the organization, and the financial implications of different remediation options. C-Suite leaders need this high-level view to decide whether to authorize funding, accept the risk, or pursue alternative risk treatment aligned with the organization’s risk appetite and strategic goals. While IT Operations, End Users, and Development teams will use detailed plans and technical steps, the decision to invest in costly mitigations rests with executive management who oversee budgets and governance.