Key Risk Indicator (KRI)

A KRI is a measurable signal that a risk is increasing. Examples include: number of incidents per month, patch coverage rate, time since the last vulnerability scan, proportion of critical functions held by a single vendor. Each KRI has a threshold; when it is breached, an alert is triggered.

The difference from an ordinary metric is that a KRI is linked to a specific risk and has a defined response. The point is not a pretty chart but ensuring that someone receives a signal before a problem develops.

Well-configured KRIs shift risk management from reactive to proactive. In practice, a breached threshold should generate a notification that reaches the right person, rather than disappearing into a dashboard that no one reads.