In AI security programs, what is the difference between KPIs and KRIs?

• A. KPIs measure regulatory exposure; KRIs measure team performance.
• B. KPIs measure performance toward objectives; KRIs measure exposure to potential risks.
• C. Both measure performance toward objectives.
• D. KRIs measure success metrics; KPIs measure risks.

Answer: (B)

KPIs and KRIs fulfill different roles in an AI security program. KPIs track how well you’re performing relative to your goals—they’re about progress toward objectives. They answer the question: are we achieving what we set out to accomplish? For example, you might measure detection accuracy against target levels, average time to patch vulnerabilities, or compliance scores. These metrics show whether the program is delivering the expected outcomes.

KRIs, on the other hand, gauge the program’s risk exposure. They’re about how much risk you’re carrying that could undermine those objectives. Examples include the number of unresolved high-risk vulnerabilities, the percentage of systems with critical misconfigurations, indicators of potential data leakage, or supplier risk indicators. These metrics help you understand where threats to success are coming from and where to focus risk mitigation.

In practice, you use both: KPIs to monitor performance toward objectives and KRIs to monitor risk posture so you can intervene before risks materialize into failures. This distinction is why the best answer states that KPIs measure performance toward objectives while KRIs measure exposure to potential risks.