Open the security section of your last board deck. The slides will tell you exactly what happened during the previous quarter. Incidents responded to. Findings closed. Patches applied. Hours spent on questionnaires. Coverage achieved. Audit gates passed.
Notice what is not on any of those slides: where the program is heading next quarter.
Almost every existing GRC board report is structurally backward- looking. Not as a design choice. As an accident of how the underlying indicators get computed.
The lagging-indicator default
A lagging indicator measures something that already happened. A leading indicator predicts something that has not happened yet. The distinction is older than risk management as a profession; it comes from operations and quality control. The Toyota Production System leaned hard on leading indicators in the 1970s because catching a defect before it happened saved orders of magnitude more than measuring how many defects had escaped.
Security and risk programs know the distinction in theory. In practice, almost every indicator on the board pack is lagging:
- Incident count. Past events.
- Loss events booked. Past dollars.
- Mean time to detect. Average of past detections.
- Audit findings closed. Past work.
- Vulnerabilities patched. Past patches.
These are all useful. None of them tell the board which way the program is moving.
Lagging indicators are easy to compute. The data already exists in the ticket system, the SIEM, the vulnerability scanner’s history. Building a leading indicator requires structural analysis of the environment, not just counting what came out of a tool. The default option is the easy option, and the easy option is lagging.
What a leading indicator actually requires
Four things have to be true for an indicator to be leading rather than lagging.
Most existing risk dashboards have zero indicators that meet all four. Some have one or two — the cyber insurance policy renewal-date countdown is technically leading. Most are zero for four.
The Risk Posture Index as the headline leading indicator
The Risk Posture Index is a composite leading indicator. It rolls up structural, behavioral, conditional, and financial indicators into a single number that represents forward risk pressure. The product shows it alongside the traditional Program Health score, which is a lagging composite: Program Health tells you where you are today (Grade B, mature program, compliant); Risk Posture Index tells you where you are heading (Grade D, attack surface accelerating, two exposures match active exploit campaigns).
The two numbers can disagree. That is the point. A mature program with good Program Health can still have a Risk Posture Index that’s sliding because the underlying structure is changing in a way the lagging metrics have not caught up to yet.
Two columns. Where we are today (Program Health). Where we are heading (Risk Posture Index, with trend arrow). When those two numbers move in opposite directions, the board notices. That slide alone is worth the meeting.
What changes for the board
Boards do not want to manage your program. They want to govern it. The difference is that managing means tracking activity; governing means knowing whether the program is on a path to produce the outcomes the company expects.
A backward-looking board report optimizes for accountability for the past quarter. A forward-looking board report optimizes for the decisions the board has to make next quarter. Those are not the same decisions.
Three specific things change when leading indicators replace lagging ones on the board pack:
Budget conversations get easier.“We need more headcount” is a hard ask when the lagging metrics show the program is performing. “The Risk Posture Index is sliding because we are taking on three new high-concentration vendors next quarter and we need the headcount to handle the increased monitoring surface” is a different conversation.
Cyber insurance renewal gets easier. Carriers increasingly want forward-looking indicators in renewal applications — they have been burned too many times by backward-looking compliance scores that did not predict the breach. A board pack that already shows leading indicators translates directly to the underwriting narrative.
The CISO stops being the person who only shows up after bad things happen. Backward-looking reporting frames the security function as a clean-up operation. Forward-looking reporting frames it as a forecasting function. Different role, different career arc, different conversations with leadership.
What this does not replace
Forward-looking indicators do not replace incident-response reporting. When something goes wrong, the board still needs the timeline, the impact, the remediation status. That reporting is lagging by nature, and that is fine — it serves a different purpose. The point is not that lagging indicators are bad. The point is that a board pack composed only of lagging indicators is structurally backward-looking, which means the board is governing by looking in the rearview mirror.
The next article in this series goes one level deeper into how one specific class of leading indicator actually gets computed: the conditional exposure indicator that fires when a third-party incident becomes time-sensitive.
Where this matters next
Why your KRIs stopped predicting anything — the pillar. The four failure modes of every existing KRI program, and what an indicator has to be to actually predict anything.
"Why this probability": showing your work in conditional exposure — the Bayesian decomposition that produces an exposure number from base rate plus signals minus controls. The clearest example of what an auditable leading indicator looks like.
The $150K GRC dirty secret: manual KRIs at enterprise prices — why the enterprise GRC platforms have not solved this yet, despite charging for it.
Conditional exposure analysis: why your risk isn't what the vendor reported — the mathematical core of the conditional indicator — what the system runs every time a vendor incident hits the platform.