| Reminds me of Goodheart's law[1]. We have known this for a long time, but it is hard to have an alternative system which scales well with huge organizations. For startups and small companies, I could see an informal system working pretty well, but as the company grows to hundreds or thousands of employees, it becomes necessary to standardize and have some kind of metrics used for reporting and evaluations. This will inevitably shift the company's culture towards gaming those metrics. Somewhat like grading systems in education. High grades don't necessarily mean you will be capable of generating more value to society than average grades or even low grades. And students often become good at improving their grades without that actually adding much value. But there is a correlation. And we don't have many better (non-experimental) alternatives that I'm aware of. [1] https://en.wikipedia.org/wiki/Goodhart%27s_law |
Yes, but that's only the beginning of the story. People gaming metrics is a type of security problem, in that "attackers" try to game the metrics while "defenders" try to make them less game-able by improving the accuracy and precision of how the metrics are gathered so that the final numbers continue to tell a valuable story over time.
The issue isn't that metrics can be gamed; it's that organizations which pride themselves on being data-driven rarely make the investment in hiring blue teams and red teams to defend and attack the metrics. If you appreciate that investing in cyberdefense is key to protecting your company from cybersecurity threats, why can't you appreciate that investing in "metricsecurity" is key to protecting your company from "metricsecurity" threats?