A CISO is preparing a quarterly report for the board of directors. The board has complained that previous reports were too technical and did not help them understand whether the security program is trending toward or away from acceptable risk levels. The CISO wants to include a metric that predicts increasing exposure before an incident occurs, allowing leadership to authorize additional investment proactively. Which type of metric BEST satisfies this requirement?