Management wants an indicator that will warn of increasing exposure to account-compromise risk before any loss occurs. Which metric BEST meets this need?
Select an answer to reveal the explanation.
Short Explanation
A smoke detector beats a fire report. You want an indicator that rises while the risk is building, like privileged accounts still missing MFA, not one that counts the damage after it's already happened.
Full Explanation
A key risk indicator is most useful when it is leading, meaning it changes as exposure grows and before the risk materializes as loss. The share of privileged accounts lacking multifactor authentication measures a condition that directly increases the likelihood of account compromise, so a rising trend gives management time to act. Trending it monthly turns a point measurement into an early-warning signal that can be compared against a threshold. Counting confirmed account-takeover incidents is a lagging measure; by the time the number moves, the compromise has already occurred. Annual fraud losses are even further downstream, reporting financial impact long after the events that caused it, which is valuable for validating risk estimates but not for early warning. The password-reset service-level metric is a key performance indicator for help desk efficiency; it measures how well a process performs, not how much risk the organization faces. Exam caveat: lagging indicators still belong in reporting because they confirm whether leading indicators are predictive; the question asks specifically for advance warning. Operational check: confirm the indicator has a defined owner, data source, threshold and escalation path, and review whether its movements have historically preceded incidents.