Key Risk Indicators for Security and Resilience

What is a key risk indicator?

A key risk indicator is a measure that gives early warning that exposure to a risk is rising or falling. It is not a measure of the risk itself, which is usually assessed as a combination of likelihood and consequence. It is a signal that the assessment may need to change.

Three kinds of indicator are often confused. Key performance indicators show whether a process is meeting its targets. Key control indicators show whether a control, such as an access card review or a patrol schedule, is working as designed. Key risk indicators show whether the conditions that make a risk more likely or more serious are present. The same data can serve more than one purpose: overdue access card reviews are a control failure and also a sign that the risk of unauthorised access is rising.

Indicators are either leading or lagging. A leading indicator moves before a risk event, such as a growing number of doors reported as propped open. A lagging indicator records what has already happened, such as the number of unauthorised entries. Lagging indicators are easy to collect and useful for trends, but by the time they move the damage is done. A useful set includes both, with more weight on leading indicators.

Where do KRIs fit in risk management standards?

AS ISO 31000:2018 treats monitoring and review as part of the risk management process, not an afterthought.¹ KRIs are one of the most practical ways to do that monitoring between formal reviews. The security risk assessment method in SA HB 167:2025 follows the same approach for security risks.

For Australian Government entities, PSPF Release 2026 requires the security plan to set out the entity’s tolerance to security risks, agreed by the Accountable Authority.² Tolerance is what gives a KRI its meaning: the threshold on each indicator should mark the point where a risk is moving outside what the entity has agreed to accept. Critical infrastructure entities covered by the SOCI Act must keep their risk management program up to date and report on it each year, and KRIs give the board evidence for that report.³

See the security risk management framework guide for how these standards fit together.

Key risk indicator examples for security and resilience

These examples show the kind of indicator that works for common security and resilience risks. The thresholds are illustrative only; set your own from your risk tolerance and the data you actually hold.

How to set useful KRIs

1. Start from the risk register. Pick the high and extreme risks first. An indicator with no risk behind it is just a statistic.
2. Ask what would change first. For each risk, list the conditions that would make it more likely or more serious, then find the data that shows those conditions.
3. Use data you already collect. Access control systems, incident logs, HR records, maintenance systems and supplier reports usually hold what you need. A KRI that needs a new manual count every month will not survive.
4. Set thresholds from your tolerance. A simple green, amber and red scale works. Agree in advance what happens at amber and at red, and who decides.
5. Name an owner and a cycle. Each indicator needs someone who reports it and someone who acts on it, and a reporting frequency that matches how fast the risk can change.
6. Review the set every year. Drop indicators nobody acts on, and add new ones as risks change.
7. Act on red. When an indicator crosses its threshold, the response usually means new or stronger controls; see the risk mitigation guide.

How to track emerging risks

Emerging risks are risks that are new, changing quickly or not yet understood well enough to assess with confidence. They cannot be measured with a KRI yet, so they are tracked differently: through horizon scanning, kept on a watch list and reviewed at a set interval, usually each quarter.

Useful sources for security and resilience include ASIO’s Annual Threat Assessment,⁴ the National Terrorism Threat Level,⁵ updates from the Cyber and Infrastructure Security Centre, the annual PSPF release, seasonal weather and bushfire outlooks, and incidents affecting similar organisations. For each item on the watch list, record what it is, why it might matter, what would tell you it is becoming real, and when it will next be reviewed. Once a risk is understood well enough, move it onto the register and give it proper indicators.

Common mistakes with key risk indicators

• Too many indicators, so none of them gets attention.
• Indicators with no threshold, so nobody knows when to act.
• Only lagging indicators, so the report describes the past.
• Data that nobody trusts, because it is collected by hand or from different systems.
• Reports that go to people who cannot change anything.

How Agilient helps

Agilient builds KRIs as part of security risk assessments and security risk management programs, so the indicators come straight from the risks that matter to the organisation. For resilience, indicators are linked to business continuity testing and exercises. Agilient’s consultants each have at least 20 years’ experience, and Agilient does not sell security products or monitoring services.