Translating technical penetration test findings into board-level risk decisions and executive governance frameworks.