Lion Cipher Lab
Tell a real KRI shift from noise with a control chart
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Security dashboards are full of key risk indicators (KRIs): critical vulnerabilities open past their deadline, phishing click rates, overdue access reviews. Every month someone asks the same question about each one: it went up, so is something wrong? The usual answer is a rule of thumb, such as investigating any change over 20 percent. That rule ignores the fact that every metric varies naturally from month to month. It raises alarms about noise, sends people chasing causes that do not exist, and then misses a slow, real deterioration because no single month jumps. Statistical process control…
What you'll learn
- why month-over-month percentage changes mislead
- building an individuals (XmR) control chart
- control limits from a baseline: centre +/- 3 MR-bar / 1.128
- the 8-in-a-row run rule for sustained shifts
- measuring false alarms and detection delay
- choosing the baseline period
- reporting a KRI with its natural variation
Steps in this lab
- Noise, signal, and the control chart idea
- Generate 30 months of a KRI
- Write the control chart
- Run it and compare the two rules
- The honest limit: detection delay