An information security manager is designing key risk indicators (KRIs) for a program that has repeatedly been surprised by ransomware incidents. The manager wants indicators that give the business advance warning so preventive action can be taken before losses occur. Which of the following would be the MOST useful KRI to add for this purpose?