ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Cybersecurity KRI examples are specific, measurable signals that tell you when cyber risk is moving toward a level you did not accept. A key risk indicator is not a report of what happened. It is an early warning, such as the share of critical vulnerabilities past their fix deadline or the number of privileged accounts without multi-factor authentication.
Most security teams track plenty of numbers, but few are chosen to predict trouble. This guide gives 25 indicators in five groups, with sample thresholds and owners that you can adapt.
All thresholds here are illustrative. Set your own from your risk appetite, your history and your sector.
A good indicator has four traits. It is linked to a specific risk, so someone can say what the number is warning about. It is measurable from reliable data, with a clear definition. It has thresholds that trigger action. And it has an owner who can do something when it moves.
The difference between a KRI and a KPI matters here. A KPI tells you how well a process performs, while a KRI tells you how close you are to an unacceptable exposure. The comparison in cybersecurity KRI vs KPI explains it with examples, and cybersecurity metrics covers the wider set of measures.
Keep the list short. Fifteen to twenty-five well-chosen indicators beat a dashboard of two hundred that nobody reads.
Start with what attackers can reach. Useful cybersecurity KRI examples here include the percentage of critical vulnerabilities past the agreed fix date, the number of internet-facing assets without a current owner, the share of systems running unsupported software and the average age of open high-severity findings.
Sample thresholds might be amber at five percent of critical vulnerabilities overdue and red at ten percent. The right number depends on how fast you can patch and how exposed the system is. Guidance in vulnerability management metrics shows how to define the measure consistently.
Watch for gaming. If teams close tickets by risk acceptance to hit the target, the indicator improves while exposure does not. Track accepted risks as a separate measure.
| Theme | Example indicator | Sample amber / red |
|---|---|---|
| Exposure | Critical vulnerabilities past SLA (%) | 5% / 10% |
| Access | Privileged accounts without MFA (%) | 1% / 3% |
| Detection | Mean time to detect (hours) | 24 / 72 |
| Suppliers | Critical vendors without current assurance (%) | 10% / 20% |
| Resilience | Backups restored successfully in test (%) | 95% / 90% |
Identity is now the main way in. Indicators include the percentage of privileged accounts without multi-factor authentication, the number of dormant accounts older than ninety days, the share of leavers whose access was removed within one day and the number of shared or generic accounts in use.
Another strong signal is the count of privileged access changes without an approved ticket. It shows whether the process is followed in practice. Set red at any non-zero number for the most sensitive systems.
Each indicator should name a data source, such as the identity platform or HR feed, so the figure can be reproduced by someone else.
Speed matters after a compromise. Track mean time to detect and mean time to respond, and the percentage of high-severity alerts triaged within target. The difference between these two measures is covered in MTTD vs MTTR.
Add coverage measures: the percentage of critical systems sending logs to monitoring, and the percentage of endpoints with a healthy security agent. A fast response team is of little use if a third of the estate is invisible.
Include exercise results, such as the number of tabletop exercises completed in the year and the share of findings closed, since practice reveals gaps that dashboards do not.
Many incidents start at suppliers. Useful indicators include the percentage of critical vendors with a current security assessment, the number of vendors with overdue findings, the share of contracts with breach notification clauses and the count of vendors with access to production systems.
Red thresholds should reflect concentration. If one supplier supports several critical processes, a single overdue finding may deserve a stronger response than a dozen low-risk vendors with small gaps.
Report these alongside your own indicators, so the board sees that supplier exposure is part of the same picture.
Resilience indicators show whether you can recover. Examples include the percentage of backups tested by restoring in the last quarter, the time taken to restore a critical system in the last exercise compared with target, and the number of critical systems without a tested recovery plan.
People indicators include phishing simulation click rates and, more important, the reporting rate for suspicious messages, as discussed in security awareness training metrics.
Use trends, not single points. A click rate that falls from twelve percent to eight percent over three quarters tells a more useful story than one month in isolation.
Set thresholds with your risk appetite in mind. Amber means investigate, red means escalate and act. Record the reasoning for each level, and revisit it when the environment changes. See KRI thresholds for methods of calibrating values from data.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
Report in a consistent format: the indicator, the current value, the trend, the status and the action. The format in KRI reporting keeps the page to one screen, and board cybersecurity reporting explains how to present the top items to directors.
Translate the top indicators into business terms when you can. cyber risk quantification shows how to connect them to potential loss. For alignment to a framework, the NIST Cybersecurity Framework site at NIST Cybersecurity Framework organizes outcomes that map well to indicators.
Defining indicators from scratch takes time: each needs a definition, a data source, thresholds, an owner and a reporting view. Starting with a tested library saves that effort.
The Critical IT and Cybersecurity Indicators includes 153 key risk indicators in Excel templates, organized for IT and cybersecurity risk monitoring, so you can select the ones that fit, adjust thresholds and begin reporting. Pick a small set first and expand once the data flows work.
Whichever source you use, review the list twice a year and retire indicators that no longer drive decisions.
Take the indicator “critical vulnerabilities past SLA”. Definition: the number of critical-severity findings on internet-facing or production systems open longer than fourteen days, divided by all open critical findings. Source: the vulnerability scanner, refreshed weekly. Owner: head of infrastructure. Amber at five percent, red at ten percent.
In March the figure reads four percent, in April seven percent and in May eleven percent. The trend and the red status trigger a review. The cause turns out to be a backlog on legacy servers awaiting a vendor patch. The action is to add a compensating control, such as network isolation, and to set a retirement date for the oldest systems. The numbers are invented, but the process shows how cybersecurity KRI examples turn into decisions: define, measure, compare, escalate, act.
Begin with your top five cyber risks from the risk register, such as ransomware, account takeover, supplier compromise, data loss and outage. For each risk, pick two or three indicators that would warn you earlier than an incident would. This keeps the set tied to real exposure and makes it easy to explain why each measure exists.
Check data quality before you commit. If a figure needs a week of manual work to produce, it will not survive a busy quarter. Favor indicators that come straight from a tool you already run, and automate the feed once the threshold is proven.
Finally, agree reporting rhythm: weekly for operational owners, monthly for the security leadership group and quarterly for the board.
The first mistake is choosing indicators because the data is easy to get, not because they warn of a real risk. The second is having no thresholds, which turns the dashboard into decoration. The third is giving indicators to teams that cannot influence them.
A fourth mistake is reporting only green. If nothing ever turns amber, the thresholds are probably too loose. A fifth is changing definitions quietly, which breaks trends.
Finally, remember that the point is action. Each red indicator should lead to a decision, a task and a date, and the record of those actions is the best evidence that the program works.
It is a measurable indicator that signals a rising level of cyber risk, such as overdue critical patches or privileged accounts without multi-factor authentication.
Usually fifteen to twenty-five, grouped by theme. More than that makes reporting hard to read and act on.
KPIs measure how well a process performs. KRIs measure proximity to unacceptable risk and trigger escalation.
Use your risk appetite, historical data and peer benchmarks, then test and adjust. Record the reasoning.
The person who can change the outcome, usually the system or process owner, with security reporting the result.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026