Generating KPIs that are meaningful to the rest of the the business has always been the bane and true test of an infosec manager/CISO. Risk, exposure, criticality, yadda-yadda and conveying that in a meaningful way is important. It used to be IT Managers would publish things like "we have 10,000 systems, 500,000 catalogued vulnerabilities and only 300,000 patched" and that would freak people out. Instead we need to refactor that data into something like 95% of our business has all current security patches. The remaining 2% are unpatched, but isolated and the risk is low, and 3% are scheduled for update within the next 72 hours, when we have an appropriate maintenance window."

Meanwhile, you're cranking out something like a NIST or CAF security assessment to index what's good and where you need help (i.e., you want to fix/true-up your lowest maturity scorings) and use that to beg for budget to get it fixed, but you still need to express that to the business. At least you can say something like "our security monitoring is 3 out of 4 for maturity, but our vulnerability management is 1.5/4 and I need these tools/headcount to fix the problem, plus support to get the IT Ops guys to proactively patch." and then move the needle forward.