A CISO is preparing a quarterly report for the board of directors. The security operations team already produces detailed dashboards showing patch counts, mean-time-to-detect, and phishing click rates for internal management. The board, however, wants indicators that give early warning when risk exposure is trending toward levels that could threaten business objectives. Which type of measurement should the CISO emphasize in the board report to best meet this need?