Key Performance Indicator (KPI)
Definition
A metric that measures how well a specific control or process is performing against a defined target. KPIs are often lagging indicators: they reflect what the control actually achieved. Example: percentage of critical patches applied within the agreed SLA window.
- Indicator type
- Lagging
- Measures
- Control or process performance against a target
- Example metric
- Percentage of critical patches applied within SLA
- Domain
- Security metrics and continuous monitoring
Common questions
How is a KPI used differently from a KRI in a security programme?+
A KPI is reviewed after the fact to judge whether a control is performing as designed, such as patch-SLA compliance, while a KRI is monitored continuously to flag rising risk exposure before it turns into an incident, so the two feed different management decisions.
What makes a KPI useful rather than just a number on a dashboard?+
A useful KPI is tied to a defined target and an owner, is tracked consistently over time, and triggers a documented response when it falls outside tolerance, rather than being reported without any threshold or follow-up action.
Related terms
- Compliance Dashboard
- An automated reporting surface that aggregates metric and control-status data and presents it in a format aligned to one or more regulatory...
- Continuous Monitoring
- An automated control framework that applies fraud indicator tests to transactions as they are processed or on a frequent scheduled basis, generating...
- Control Effectiveness
- The degree to which a security control achieves its intended objective under real operating conditions. Measured through a combination of design review...
- Key Risk Indicator (KRI)
- A metric that measures the level or trend of a specific risk exposure. KRIs are often leading indicators: they change before a...
- SIEM (Security Information and Event Management)
- A platform that aggregates log and event data from systems, networks, and applications across an environment, correlates events against detection rules, generates...