The percentage of unpatched systems is a:

A threat vector is the path or method an attacker uses to gain unauthorized access or deliver malware, not a metric of a system's state.

A critical success factor (CSF) is an element necessary for an organization or project to achieve its mission or goals, not a specific risk metric.

A key performance indicator (KPI) measures how well an organization is achieving its strategic and operational goals, typically related to output or efficiency, rather not risk levels.

A Key Risk Indicator (KRI) is a metric used to provide an early signal of increasing risk exposure for an organization, where a higher percentage of unpatched systems directly indicates increased vulnerability and potential for a security incident. Monitoring this metric helps proactively manage and reduce the likelihood of successful attacks due to unaddressed vulnerabilities.