Key Risk Indicators (KRIs)

Key Risk Indicators are measurable metrics used to provide early warning signals of increasing risk exposure, enabling organizations to take proactive action before risks materialize into incidents. In third-party cyber risk management, KRIs might include a vendor's Ransomware Susceptibility Index® (RSI™) score, the number of critical unpatched vulnerabilities, changes in compliance rating, or financial impact thresholds. Tracking KRIs across a vendor portfolio supports continuous monitoring and escalation workflows.

What Makes a Metric a Key Risk Indicator Rather Than a KPI?

A key risk indicator (KRI) is a metric that signals rising exposure to a risk before that risk turns into a loss. It's easy to confuse with two related metric types, and each measures something different:

Key risk indicator (KRI), exposure to a potential risk event, such as the share of vendors carrying unpatched critical vulnerabilities.
Key performance indicator (KPI), progress toward a goal, such as the share of vendor assessments completed on schedule.
Key control indicator (KCI), how well a control works, such as the share of access reviews finished on time.

A KPI and a KRI often come in pairs. Completing every vendor assessment is a performance goal, while the number of vendors with unresolved critical findings is the matching risk signal.

Leading Indicators Carry the Warning Value

KRIs come in two types. Leading indicators change before a risk event occurs, which gives a team time to act. Lagging indicators change after the event. For vendor risk, a rising count of exposed vulnerabilities is a leading indicator, and a vendor's breach disclosure is a lagging one.

Which KRIs Point to a Third-Party Incident?

Black Kite's research correlates specific technical conditions, such as unpatched known exploited vulnerabilities and credentials exposed in stealer logs, with third-party breach outcomes. That makes externally observable conditions a practical base for vendor KRIs. Candidates include:

Ransomware susceptibility above a set threshold, measured from outside the vendor.
Open known exploited vulnerabilities, especially on internet-facing systems.
Corporate credentials in stealer logs, which let attackers log in as legitimate users.
Aging critical findings, meaning critical issues left unresolved past their remediation window.
Rating decline, a drop in the vendor's cyber rating beyond an agreed amount.

How Should KRI Thresholds Tie to Risk Appetite?

A KRI threshold turns a metric into a decision point, and the level where it sits should come from the organization's defined appetite for risk. The organization's risk appetite sets how much risk it's willing to pursue, and its risk tolerance sets how far a measure can drift before someone acts. Each KRI also needs an owner who's responsible for acting when it crosses the line.

A Threshold Backed by Data Is Easier to Defend

Black Kite's 2026 Third-Party Breach Report gives one example of a data-backed threshold. Companies with an RSI above 0.4 are 11.6x more likely to experience a ransomware attack than those below 0.2, according to the report. A vendor KRI set at 0.4 has that finding behind it.

Why Can a Strong Vendor Rating Hide a Rising Risk?

A letter grade averages many categories, so one indicator can move toward danger while the overall grade stays high. Black Kite's cyber rating is a weighted average of 19 graded technical categories, as its risk management methodology describes. The Third-Party Breach Report shows the gap this can hide. Across roughly 200,000 monitored organizations, the average grade was 90.27, an A, while the average RSI sat at 0.378, close to the 0.4 threshold. Tracking ransomware susceptibility as its own KRI surfaces what the grade alone doesn't.

How Should Vendor KRIs Be Reported?

A KRI report is useful when it shows direction and response, not just the current number. Leadership needs to know which indicators are moving, which have crossed a threshold, and what's being done about it. A vendor KRI report can cover these elements:

Trend over time, since a single reading can't show whether risk is rising or falling.
Threshold breaches, listing each vendor that crossed a limit since the last report.
Owner and action, naming who responded to each breach and what they did.
Concentration, showing whether several breaches trace back to the same vendor or shared provider.

Review Frequency Should Match the Data

A KRI built on continuously monitored data can be reviewed whenever it moves. A KRI built on questionnaire answers only changes when the next questionnaire comes back. Mixing the two in one report without labeling the difference makes stale indicators look current.

Where Do Vendor KRIs Break Down?

Externally derived KRIs measure what can be observed from outside a vendor, and they can't see internal controls, policies, or processes. Those still need assessment evidence. A threshold with no owner or response plan also flags risk without triggering any action. KRIs work as part of a vendor's overall risk posture, alongside assessments and contract terms.

How Do Black Kite's Ratings and Indices Feed a KRI Program?

Black Kite supplies external signals that vendor KRIs can be built on, and it alerts teams when a vendor's risk profile changes. Its cyber risk monitoring platform tracks cyber posture across a vendor portfolio, so a change surfaces within Black Kite’s regular scan cycle instead of at the next quarterly assessment. The Ransomware Susceptibility Index® (RSI™), a predictive ransomware indicator, identifies vendors with the technical conditions that make ransomware attacks likely. FocusTags® map breaches, active exploits, and CVEs to specific vendors, and the Credential Management category surfaces leaked and stealer-log credentials.

These signals support vendor risk monitoring programs that track KRIs across the whole portfolio. The TPCRM knowledge center collects Black Kite's related resources.