Which of the following actions should a risk practitioner do NEXT when an increased industry trend of external cyber attacks is identified?

An industry trend of increased cyber attacks signifies a heightened threat landscape. Conducting a threat and vulnerability analysis will help determine if the organization is susceptible to these specific types of attacks, identify potential weaknesses, and assess the likelihood and potential impact on the organization's assets. This analysis provides the necessary details before escalating or modifying risk treatments.

Notifying senior management is important but typically follows an assessment of the *specific* impact and likelihood to the organization, which is determined by a threat and vulnerability analysis.

Updating the risk impact rating prematurely without understanding the organization's specific vulnerabilities and exposure to the new trend could lead to inaccurate assessments.

Updating KRIs might be a subsequent step if the analysis reveals new indicators, but the immediate need is to understand the direct implications for the organization.