A recent vulnerability assessment of a web-facing application revealed several weaknesses. Which of the following should be done NEXT to determine the risk exposure?

A code review might identify more vulnerabilities but doesn't actively test exploitability to determine immediate risk exposure.

A penetration test is the next logical step after a vulnerability assessment to determine true risk exposure. While a vulnerability assessment identifies potential weaknesses, a penetration test actively attempts to exploit those vulnerabilities, simulating a real-world attack to assess the likelihood and impact of successful exploitation, thereby providing a clear picture of the actual risk to the organization.

A gap assessment identifies differences between current and desired states, which is broader than determining specific risk exposure from identified vulnerabilities.

A Business Impact Analysis (BIA) quantifies the impact of disruptions but doesn't directly assess the exploitability of specific technical vulnerabilities.