<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Key Risk Indicators — API Reference

## KRI Schema

```json
{
  "kri_id": "KRI-0001",
  "name": "Patch Compliance Rate",
  "data_source": "vulnerability_scanner",
  "collection_frequency": "daily",
  "thresholds": { "green": ">95", "amber": "80-95", "red": "<80" },
  "current_value": 92.5,
  "current_status": "amber",
  "trend": "improving"
}
```

## Agent Commands

```bash
# Define new KRI
node agent.js --action define --name "Patch Compliance" --source vuln_scanner

# Collect KRI data point
node agent.js --action collect --input kri_config.json --value 92.5

# Generate KRI dashboard
node agent.js --action report --input kris.json --output dashboard.json
```

## Common Security KRIs

| KRI | Source | Frequency | Green | Amber | Red |
|-----|--------|-----------|-------|-------|-----|
| Patch compliance | Vuln scanner | Daily | >95% | 80-95% | <80% |
| MTTD | SIEM | Real-time | <4hr | 4-24hr | >24hr |
| MFA adoption | IAM | Weekly | >98% | 90-98% | <90% |
| Phishing click rate | Phishing sim | Monthly | <3% | 3-8% | >8% |
| Open critical vulns | Vuln scanner | Daily | 0 | 1-5 | >5 |
