Translate technical findings into quantified business impact and tie each to a specific executive priority.
1. Asset inventory – Pull the latest CMDB export (e.g., cmdb_export.csv) and map each IP/hostname to a business function. Use the asset value column from the finance system (e.g., asset_value_usd).
2. Vulnerability scoring – Run automated scanners (Nmap -sV -oX scan.xml, Nessus, or OpenVAS) and export CVSS v3.1 scores. Classify: ≥7.0 = high, 4.0‑6.9 = medium, <4.0 = low.
3. Threat likelihood – Use MITRE ATT&CK technique prevalence data (e.g., attack_technique_counts.csv) to assign a likelihood factor (0‑1). For a technique seen in >30 % of recent APT reports, set likelihood = 0.8.
4. Risk calculation – Apply the formula:
```python
def expected_loss(asset_value, likelihood, cvss):
return asset_value likelihood (cvss/10)
```
Multiply the result by 1.2 for regulatory penalties if the asset holds PII.
5. Business impact narrative – Convert the numeric loss to a concise statement: "Potential $2.3 M revenue loss if the CRM database is exfiltrated."
6. Executive framing – Align each finding with a KPI (e.g., Net‑Revenue Retention, SLA compliance). Use a one‑page heat map: rows = business units, columns = risk tier.
7. Actionable recommendations – Prioritize remediation by descending expected loss, and attach a concrete deadline (e.g., patch within 14 days, implement WAF rule SecRuleEngine On).
Gotcha: Executive dashboards truncate text at 150 characters; keep the risk statement under that limit or provide a QR‑code link to the full analysis.