A vulnerability dashboard reports total findings but not business exposure. What is the best improvement?

1. Show only the number of purchased scanner licenses
2. Remove old unresolved issues from the denominator
3. Include criticality, exploitation context and remediation age
4. Count every informational finding as a confirmed breach