An organization has implemented a control for penetration testing and red team exercises conducted on their network. They have compiled metrics showing the success of the penetration testing (Penetration Tests), as well as the number of actual adversary attacks they have sustained (External Attacks).
Assess the metrics below and determine the appropriate interpretation with respect to this control.
A . The blue team is adequately protecting the network
B . There are too many internal penetration tests being conducted
C . The methods the red team is using are not effectively testing the network
D . The red team is improving their capability to measure network security
Answer: C