Key Risk Indicators (KRIs)

Key Risk Indicators are measurable metrics used to provide early warning signals of increasing risk exposure, enabling organizations to take proactive action before risks materialize into incidents. In third-party cyber risk management, KRIs might include a vendor's Ransomware Susceptibility Index® (RSI™) score, the number of critical unpatched vulnerabilities, changes in compliance rating, or financial impact thresholds. Tracking KRIs across a vendor portfolio supports continuous monitoring and escalation workflows.