During a penetration test, new vulnerabilities were discovered that were not part of the original test plan. The team decides to shift their focus to address these findings immediately. What process is the team engaging in?

• A. Scope Creep
• B. Retesting
• C. Goal Reprioritization
• D. Risk Assessment

Answer: (C)

Goal reprioritization is what’s happening. When new vulnerabilities appear that weren’t in the original plan, the team adjusts what to tackle first based on risk and impact, shifting priorities to address the most critical issues immediately. This keeps the engagement responsive to what matters most without automatically expanding the overall scope. Retesting would focus on verifying fixes for previously found issues, not addressing new findings. Risk assessment is about evaluating threats and likelihoods, not about changing the current task order. Scope creep would mean adding work outside the agreed boundaries, which isn’t implied here—the emphasis is on reordering what’s being worked on within the existing engagement.