The most likely cause for the high number of findings is that the vulnerability scanner was not properly configured and generated a high number of false positives. False positive results occur when a vulnerability scanner incorrectly identifies a non-vulnerable system or application as being vulnerable. This can happen due to incorrect configuration, over-sensitive rule sets, or outdated scan databases.
https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/sy0-601-comptia-security-plus-course/

The company should implement Data Loss Prevention (DLP) to prevent employees from stealing data when accessing network shares. Reference:
CompTIA Security+ Study Guide Exam SY0-601, Chapter 8

Explanation
A cloud access security broker (CASB) is a security solution that enforces access policies for cloud resources and applications, providing visibility, data control and analytics. A CASB can meet the requirements of the company by offering the following benefits:
Visibility into how teams are using cloud-based services, such as shadow IT assessment and management, granular cloud usage control, and risk visibility.
Ability to identify when data related to payment cards is being sent to the cloud, such as data loss prevention (DLP) capabilities that can protect sensitive information and prevent unauthorized sharing.
Data availability regardless of the end user's geographic location, such as inter-Region peering encryption on the AWS global private network or other cloud platforms.
Single pane-of-glass view into traffic and trends, such as central policy engine, continuous monitoring, and threat prevention. References: What Is a Cloud Access Security Broker (CASB)? | Microsoft; Top
10 Cloud Access Security Broker (CASB) Solutions for 2023; Definition of Cloud Access Security Brokers (CASBs) - Gartner

A security control objective cannot be met through a technical change, so the company implements a policy to train users on a more secure method of operation best describes a risk reduction technique. Risk reduction is a strategy that aims to lower the likelihood or impact of a risk by implementing controls or mitigations. For example, if a technical control is not feasible or cost-effective, a company can reduce the risk by educating users on how to avoid or handle the threat, such as using strong passwords, avoiding phishing emails, or reporting incidents.