// GLOSSARY

Management Visibility

Decision-support offensive-assurance visibility built for management through a monthly executive summary, quarterly risk trend, closure rate and the next month's priority area; it is the management leg of the Continuous Penetration Test. It is not an 'executive report' alone; it is the programmatic, that is, regularly repeated over time, form of two-layer delivery. The problem the concept solves is the chronic disconnect between security work and management decision. The technical team finds and closes vulnerabilities with intense effort, but this effort often has no visible counterpart at the management level; management cannot find a concrete answer to 'is security good or bad', because what reaches it is either an unreadable technical report or nothing. Management visibility closes this gap and turns security into a trend management can track, compare and decide on. Thanks to this visibility an executive can answer 'has our risk fallen since last quarter, how long do critical findings take to close, where should I allocate resources next month'. Its aim is to take security work out of being a technical activity and turn it into a business metric, that is, a manageable process; the mean time to remediate (MTTR) and the closure rate are the decision metrics of this visibility.