Continuous Indicators
Risk indicators that move before the loss does. Our editorial home for the methodology behind Continuous Indicators — how leading risk signals get derived from a live environment, how thresholds get calibrated against the events they predicted, and what changes for a lean team when the board report updates hourly instead of quarterly.
Calibration: how we know our indicators are actually right
Anyone can build a risk dashboard. The hard part is convincing an auditor that the numbers are correct. Most products skip this; we publish each indicator's Brier score against realized outcomes. The calibration discipline that distinguishes a real leading-indicator framework from prettier dashboards.
What changes for a 35-person company when risk posture updates hourly
A two-person security function at a Series B SaaS company. Until this year, board risk reporting was a spreadsheet the lead updated the weekend before the meeting. Now the Risk Posture Index moves overnight, the team responds in hours, and the board meeting takes 20 minutes to prep. The operating model, in detail.
The $150K GRC dirty secret: manual KRIs at enterprise prices
Enterprise GRC platforms charge $150K-$500K per year for software that automates the dashboard layer but requires the customer to do every part of the indicator-design work. The price is for the chart, not for what the chart shows. The verified competitive landscape across MetricStream, Archer, IBM OpenPages, ServiceNow GRC, and LogicGate.
"Why this probability": showing your work in conditional exposure
Most cyber-risk dashboards produce a single number and ask you to trust it. Those numbers are not defensible to a CFO. The Bayesian decomposition that produces an auditable exposure: base rate plus your specific signals minus your specific controls equals the posterior. Worked example from a live GitHub credential campaign.
Forward risk vs. backward risk: the board report that shows where you're headed
Every existing GRC board report is structurally backward-looking. Not as a design choice, as an accident of how the underlying indicators get computed. The leading-vs-lagging framing, what a forward-looking indicator actually requires, and the headline slide that changes the board conversation.
Why your KRIs stopped predicting anything
Open your last board report. Find the Key Risk Indicators page. How many of them actually warned you before something happened? For almost every mid-market security program in 2026, the answer is none. Here is why — and what an indicator should be instead.