Which of the following is the MOST appropriate metric to demonstrate the effectiveness of information security controls to senior management?

The number of security vulnerabilities is a technical metric that does not directly translate into business impact or financial risk for senior management.

The percentage of servers patched is an operational metric indicating security hygiene, but it doesn't directly show the effectiveness of controls in reducing business loss to senior management.

Downtime due to malware infections is a valid operational metric, but annualized loss provides a more comprehensive financial quantification of security control effectiveness over time and in business terms.

Annualized loss resulting from security incidents is the most appropriate metric for senior management because it quantifies the financial impact of security failures in business terms, allowing them to understand the return on investment for security controls and the overall risk exposure. This metric directly addresses the business value and financial implications of security, which is paramount for executive decision-making.