Better or Worse? — TechKnowSurge

About this interactive

A business is there to make a profit, by increasing revenue or decreasing costs, and a security program should do one or the other. Reliability and availability raise the customer rating and so sales; scalability makes things manageable and so cuts costs. Talking in those terms is how security projects get approved. The lesson's way to show the value is to track indicators over time and look at the trend. - Key performance indicators (KPIs) show what is improving because of the investment: uptime, satisfaction, the share of systems patched or encrypted. Going up is good. - Key risk indicators (KRIs) work like insurance: if the program is working, they should go down. The number of incidents, unpatched critical flaws, leavers still active, failed restore tests. Going up is bad. So the word on the card, rose or fell, does not answer it. Ask first what is being measured: a measure of performance, or a measure of risk? Then read which way it moved. Security+ lists key risk indicators in the risk register, under risk management.

What you'll learn

Read a trend in a key performance indicator or a key risk indicator and say whether the security program's picture is getting better or worse
Recognize that a working program shows KPIs improving and KRIs falling, and outcomes that raise revenue or cut costs

Aligned to

CompTIA Security+

5.2 Explain elements of the risk management process.

NIST 800-53

PM-6 Measures of Performance

Key terms

Key Performance Indicators: Measurable values tracked over time to assess the health and performance of systems or an organization.
Key Risk Indicators: Key Risk Indicators are forward-looking metrics that provide early warning signals of increasing risk exposures, enabling organizations to take proactive action before risk thresholds are breached.
Risk Trend Analysis: The process of examining data points collected over time to identify patterns or directional changes in risk levels.
Cybersecurity Program Management: The overarching coordination of people, budgets, roles, and resources across all security functions to ensure a unified and effective organizational security posture.

Topics

Security Metrics Kpi Kri Security Program Management Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →