A risk practitioner is defining metrics for security threats that were not identified by antivirus software. Which type of metric is being developed?

Key Control Indicators (KCIs) measure the effectiveness of controls, not the emergence of new or undetected threats.

Key Risk Indicators (KRIs) are metrics used to monitor the level of risk an organization faces, providing an early warning signal of increasing risk exposure. When antivirus software fails to identify threats, it indicates a potential gap or emerging threat landscape, which is precisely what a KRI would track to alert management to heightened risk.

Operational Level Agreements (OLAs) are internal agreements that define service levels between internal departments, unrelated to external threat detection.

Service Level Agreements (SLAs) are external agreements defining the expected level of service from a provider, which is not directly relevant to identifying new threats.