During a penetration test, you identify a misconfiguration that exposes sensitive data. According to best practices, what is the most appropriate step to take in terms of communication?
Immediately notify the primary or emergency contact to discuss the finding.
Wait until the presentation of findings to demonstrate the full impact of the misconfiguration.
Include the sensitive data exposure in the next scheduled status report.
Save the finding for the final report to prevent causing alarm during the test.