The DORA research program measures software delivery with five metrics: change lead time, deployment frequency, failed deployment recovery time, change fail rate and deployment rework rate. None of them measures security directly, but security work moves all five, so read them next to a few security measures.
Not the EU regulation
A quick disambiguation, because search results mix the two. This post is about DORA, the DevOps Research and Assessment program, which studies how software teams deliver. It is separate from the EU Digital Operational Resilience Act, which shares the acronym. If you are after the regulation, Safeguard has other posts on that.
The five metrics
DORA's guide groups them into throughput and instability.
| Metric | Group | DORA's definition, in short | Where security shows up |
|---|---|---|---|
| Change lead time | Throughput | Time from commit to version control to deployed in production | Scan and review steps sit inside this window |
| Deployment frequency | Throughput | Number of deployments over a period, or time between them | Gates that block often can lower it |
| Failed deployment recovery time | Throughput | Time to recover from a deployment that fails and needs immediate intervention | A bad security change that needs a rollback counts here |
| Change fail rate | Instability | Ratio of deployments that need immediate intervention | A deployed vulnerability fixed by hotfix can count |
| Deployment rework rate | Instability | Ratio of deployments that are unplanned but result from a production incident | Emergency patches for exploited issues land here |
The guide says top performers do well across all five and low performers do poorly. It does not publish cluster thresholds on that page, so be wary of any chart that claims exact bands without a source.
Where security work pushes on each metric
Lead time is the obvious one. Every scan, approval and manual review adds minutes or days to the path from commit to production. The useful question is how much of lead time a control owns, and whether that time buys anything. Our post on whether security gates hurt DORA lead time shows how to measure it.
Deployment frequency can fall if a gate is noisy and teams batch changes to avoid it. Batching tends to hurt later, because bigger changes are harder to review and more likely to fail.
The instability metrics are where late-found security problems hurt. A vulnerability caught in a pull request costs one failed check. The same vulnerability found after release can cost an urgent deployment, which raises rework rate. For classification rules, see does a security failure count as a DORA change failure.
What DORA does not give you
The five metrics say nothing about how many known vulnerabilities you carry, how long they stay open, or whether you can find affected software quickly. You need separate measures for that. A reasonable starter set is time to remediate by severity, count of open exploitable findings, and share of services covered by scanning.
A simple way to start
- Pick one service. DORA says the metrics are meant for one application or service at a time.
- Record the five metrics for it for a month.
- Add two security measures beside them: time to remediate and scan coverage.
- Review the seven numbers together, and look for tension. If lead time improves while rework rate climbs, speed is costing stability.
Quick check
Are DORA metrics security metrics?
No. They measure delivery speed and stability. Security affects them, so track security measures beside them.
Is DORA the same as the EU regulation?
No. The delivery metrics come from the DevOps Research and Assessment program. The regulation is a separate EU law with the same acronym.
How Safeguard fits
Safeguard provides dependency and SBOM scanning with policies and gates, and continuous monitoring, so security checks run in the pipeline and their results can be counted. Try a free scan at gold.safeguard.sh/scan.
Sources
- DORA, DORA's software delivery performance metrics: https://dora.dev/guides/dora-metrics/
Last reviewed: 19 October 2026.
