Attack paths
A flat list of findings is a scanner report. A chain that says how one weakness reaches another, and what the end of it costs the business, is something a board can act on. A chain is at least as severe as its worst link, and three or more links escalate it a level.