There have been several exploits to critical devices within the network. However, there is currently no process to perform vulnerability analysis. Which the following should the security analyst…

An asset inventory catalogs what exists on the network but does not actively detect or analyze vulnerabilities and threats.

Configuring vulnerability scanning frequency to avoid workflow disruption allows continuous risk visibility while keeping production systems available and performant. A scanner set to low-impact scheduling or off-peak timing balances the need to detect critical vulnerabilities with the operational requirement to avoid service degradation. This directly addresses the lack of a vulnerability analysis process without introducing new risk to production availability.

Automated reports of already-exploited devices are reactive and provide after-the-fact information rather than proactively identifying threats before exploitation occurs.

Scanning all data regardless of sensitivity is inefficient, may violate data handling policies, and does not specifically address identifying critical threats.