The board receives hundreds of vulnerability counts but cannot determine business significance. What reporting change is best?

1. Remove all unfavorable findings
2. Send the same list more frequently
3. Show material exposure, business impact, trends, and decisions needed
4. Replace the list with vendor rankings