Leading indicators

Leading indicators describe conditions that make incidents more likely, rather than counting incidents that already happened.

Unpatched internet-facing systems, accounts without MFA, backups never tested. They are actionable now, whereas incident counts describe a past you cannot change. Most security reporting is heavily weighted towards lagging measures because they are easier to produce.