KRIs: key risk indicators every CISO should monitor

Key risk indicators, or KRIs, are trend metrics that warn the CISO when exposure to a threat is rising, before it turns into an incident. Last week's security report tells you what has already happened; a good set of KRIs points to where the next problem is likely to appear, and that buys time to act.

The challenge is rarely a lack of data. It is too much of it. Fragmented spreadsheets, one dashboard for vulnerabilities, another for compliance, a third for suppliers, and none of them talking to each other. The result is a security leader who learns about the risk from the incident news rather than from the indicator. This article shows how to choose, calibrate and connect key risk indicators so that they lead from exposure to decision.

What KRIs are and how they differ from KPIs

A KRI tracks the likelihood of a risk materialising or the size of the exposure to it. A KPI measures the performance of an activity already carried out. The difference looks subtle, but it changes how you react.

Think of a simple analogy. The KPI is the speedometer: it shows how fast you are going right now. The KRI is the engine temperature light: it comes on before the breakdown and gives you the chance to stop and avoid the damage. Both are useful, but only the second is an early warning.

Some practical contrasts in a security context:

KPI: percentage of critical vulnerabilities fixed in the month. KRI: number of critical assets left unpatched for more than 30 days with known active exploitation.
KPI: number of awareness training sessions completed. KRI: click rate in phishing tests above the historical baseline.
KPI: number of audits closed in the quarter. KRI: number of controls with expired or missing evidence.

The logic is consistent. The KPI looks back and measures delivery. The KRI looks ahead and measures the trend in exposure. A mature CISO uses both, but it is the KRI that makes it possible to act before the loss.

Early warning matters because breaches take a long time to resolve. In the 2025 edition of IBM's Cost of a Data Breach report, the average breach lifecycle, from identification to containment, was 241 days, 17 fewer than the year before (IBM, 2025). The sooner an indicator lights up, the shorter the window in which an attacker is likely to operate unseen.

How to set thresholds and alert triggers

A key risk indicator without a defined threshold is just a number on a dashboard. What turns the metric into a decision are three elements: a clear threshold, an alert trigger and an owner responsible for acting when the trigger fires.

Set thresholds by combining three reference points:

Historical baseline. How has the metric normally behaved over the last six to twelve months? A deviation from that baseline is the first signal.
Risk appetite and tolerance. How much exposure do management and the board knowingly accept? The KRI threshold must reflect that business decision, not just technical sensitivity. NIST CSF 2.0 asks for risk appetite and risk tolerance statements to be established, communicated and maintained (subcategory GV.RM-02), and tolerance is precisely the band beyond which someone has to decide. To turn appetite into numbers, see Risk appetite: from sentence to number.
Regulatory requirements. Regulatory deadlines set ceilings that cannot be exceeded. Under Resolution CD/ANPD No. 15/2024 (Article 6) of the ANPD, Brazil's National Data Protection Authority, the controller must notify the ANPD of a security incident that may cause significant risk or harm to data subjects within three working days of learning that the incident affected personal data. A KRI tied to that deadline needs to fire well before it expires.

With those reference points in hand, set up traffic-light bands and link each one to an action:

Green: within expectations. No action beyond routine monitoring.
Amber: worsening trend. Notify the risk owner and open an investigation.
Red: critical threshold reached. Trigger the response plan and escalate to management.

The trigger does not have to be an absolute value. Often the speed of change matters more than the number itself. In a hypothetical example, a 40% jump in exposed assets in a single week deserves an alert even if the total is still in the amber band. To support that calibration, link the KRIs to the initial threat prioritisation and track over time the threats that the risk matrix rated as most critical.

Examples of key risk indicators: cyber, compliance and suppliers

A good starting set covers three fronts that account for much of the material risk: technical exposure, compliance and third parties. Below are practical examples with the metric and the reason to track it. Thresholds should be calibrated with the reference points from the previous section.

Cyber risk and exposure

Critical assets missing a critical patch for more than 30 days. Measures the exposure window. The volume of new flaws puts pressure on this indicator: according to NIST, CVE submissions grew 263% between 2020 and 2025, and the first quarter of 2026 ran nearly a third above the same period of 2025 (NIST, April 2026). Prioritising fixes by risk, for example by checking whether the flaw is in CISA's KEV catalogue, rather than in order of arrival, is what keeps this KRI under control. The method is covered in 48,000 CVEs a year: where to start.
Click rate in phishing simulations. Signals the human factor. One possible amber threshold is the rate exceeding the moving average of recent quarters.
Privileged accounts without an access review in the period. Indicates privilege creep and the risk of lateral movement.

Continuous compliance

Controls with expired or missing evidence. Measures the real health of the compliance programme between audits, which matters in programmes built on voluntary frameworks such as ISO/IEC 27001, SOC 2 and NIST CSF.
Data subject requests answered late. This is direct regulatory risk. The LGPD, Brazil's General Data Protection Law, sets, for example, up to 15 days for the full statement confirming the existence of, or giving access to, personal data (Article 19, II), and leaves other deadlines to regulation (Article 18, § 5). The red threshold should fire before the deadline.
Policy exceptions open beyond the internally defined deadline. Shows friction between the defined control and real operations.

Third-party risk

Critical suppliers without a risk reassessment in the cycle. Dependence on third parties weighs more and more in breaches. In the 2026 Data Breach Investigations Report, the 19th edition of Verizon's report, breaches involving a third party reached 48% of the total, up 60% on the previous edition, which recorded 30% (Verizon, 2026 DBIR).
Suppliers with a security incident reported in the period. An immediate alert to review the contract and access.
Concentration of a critical service in a single supplier. Measures continuity and resilience risk.

For third-party KRIs to draw on consistent data, it helps to structure the process around vendor risk management best practices.

Risk executive analysing exposure and compliance metrics on a data screen

How to link KRIs to response plans

An indicator that lights up without triggering any response is noise. The value of KRIs appears when every critical threshold is tied to a documented plan, with an owner, steps and a deadline. That is the difference between monitoring risk and managing it.

For every red KRI, define a minimum flow:

Risk owner. Who receives the alert and is accountable for the decision. Without a name, the indicator has no traction.
Associated playbook. What to do when the trigger fires, in concrete steps: isolate the asset, revoke access, contact the supplier, notify legal.
Response deadline. How long the owner has to act before the situation is escalated to management.
Decision record. What was decided, by whom and on what evidence. That traceability is what supports the audit later.

This chain also supports communication with senior management. When the CISO needs to report cyber risk to the board, a red KRI with its history and associated response plan says far more than an isolated technical chart. The bridge between indicator and executive decision is what turns a security data point into a business agenda item.

The key point is to keep the decision human. The indicator prioritises and signals, but whoever decides to isolate a system or invoke a contract is the accountable owner, with the business context at hand.

Continuous KRI monitoring with a GRC platform

Tracking KRIs in spreadsheets tends to work until the first real incident. Out-of-date data, manual calculation and no link between controls, assets and suppliers mean the indicator arrives late. A GRC platform that brings those sources together in a connected view tackles three limitations of the manual approach:

A single, up-to-date source. Instead of reconciling spreadsheets, KRIs draw on a shared inventory of controls, assets and suppliers, with a history of every change.
Business context. Technical risk is linked to processes, scenarios and impact, which makes the KRI understandable to the board.
Automation with human decisions. Part of the data collection and prioritisation can be automated, but the decision stays with the accountable owner, in a human-in-the-loop model.

Eagle, Futture's Enterprise Risk Intelligence platform, was designed for this scenario. Its enterprise risk module brings together taxonomy, appetite, tolerance and indicators, with dashboards for the board, and connects to the GRC, cyber exposure and third-party modules. In the GRC module, a control mapped once can be reused across frameworks, with traceability to each requirement, which helps keep compliance KRIs consistent. The AI suggests priorities, but the user reviews, approves, rejects or adjusts every relevant output. For a wider view of this type of tool, see the guide GRC platform in Brazil: how to choose the right one.

Next step for your KRI programme

Pick three indicators, one for cyber exposure, one for compliance and one for third parties, and over the next two weeks define a threshold, an alert trigger and an accountable owner for each. That small, well-calibrated set will teach you more about your real risk than a dashboard with dozens of metrics and no decision attached. From there, expand gradually until you cover the business's material risks, and connect everything to a single view in which every red number already arrives with its response plan.

Further reading: Risk Matrix: How to Build It and Prioritise Threats; Risk appetite: from sentence to number; How the CISO should report cyber risk to the board.

Frequently asked questions

What is the difference between a KRI and a KPI?

A KPI measures the performance of something that has already happened, such as the average time to fix vulnerabilities last month. A KRI anticipates a rise in the likelihood of a risk materialising, such as growth in the number of assets missing a critical patch.

How many KRIs should a CISO monitor?

No standard sets a number. Start small, for example with three, one for cyber exposure, one for compliance and one for third parties, and expand as each new indicator gets a threshold, a trigger and an owner. Too many KRIs create noise and weaken decision-making. The aim is to focus on the risks that are material to the business, not to build a dashboard with dozens of numbers that nobody owns.

How do you set the alert threshold for a KRI?

Combine the historical baseline, the risk appetite and tolerance set by management and regulatory deadlines, such as the three working days that ANPD Resolution CD/ANPD No. 15/2024 allows for reporting significant incidents to Brazil's data protection authority. Define green, amber and red bands and link each one to a specific action, such as notifying the risk owner or triggering the response plan.

Do KRIs replace the risk matrix?

No. The risk matrix prioritises and classifies threats at a point in time. KRIs track those threats over time and warn you when exposure changes. The two tools work together in risk management.