Which of the following statements indicates that a previously failing security program is becoming successful?

A. The number of threats has been reduced.
B. More employees and stakeholders are attending security awareness programs.
C. The number of vulnerability false positives is decreasing.
D. Management's attention and budget are now focused on risk reduction.