Question

A newly implemented key risk indicator (KRI) for failed privileged-access attempts is breaching its threshold almost daily, yet subsequent investigations consistently find no actual security concern. The risk team is spending significant effort triaging alerts that lead nowhere, and management is beginning to ignore the KRI reports. What is the MOST appropriate action for the risk practitioner to take?

Accepted Answer

Recalibrate the KRI threshold based on analysis of historical data and normal operating patterns

Answer

Retire the KRI because it no longer provides value to management

Answer

Escalate every breach to the risk committee to ensure proper oversight

Answer

Reduce the monitoring frequency so fewer breaches are recorded