A penetration tester is in the process of writing a report that outlines the overall level of risk to operations. In which of the following areas of the report should the penetration tester put this?

Appendices contain supplementary material such as raw tool output, evidence screenshots, and supporting data - not high-level operational risk narrative.

The executive summary is specifically designed for non-technical stakeholders such as executives and managers, and it communicates the overall risk posture, business impact, and strategic recommendations. Placing the overall operational risk level here ensures decision-makers can grasp the severity and consequences without requiring deep technical knowledge of the underlying findings.

The technical summary addresses findings at a technical level for IT staff and security teams, not the overarching business risk statement intended for leadership.

The main body contains detailed technical findings, methodology, and exploitation steps, which is too granular a section for communicating overall risk to operations.