Goodhart's law says that when a measure becomes a target, it stops being a good measure. In security, this shows up as teams closing tickets instead of fixing risk. You cannot remove the effect, but you can pair metrics so that gaming one makes another look worse.
Where the idea comes from
Economist Charles Goodhart wrote about the pattern in a 1975 article on UK monetary policy. The common short form, "when a measure becomes a target, it ceases to be a good measure", came later. A related idea, Campbell's law, says the more an indicator drives decisions, the more it invites distortion.
DORA's guidance on software delivery metrics makes the same warning: setting metrics as targets invites gaming, and relying on a single metric oversimplifies complex systems.
Common gaming patterns
These are not malice. They are normal responses to pressure.
- Target: fewer open criticals. Response: downgrade severity, or mark items as accepted risk.
- Target: SLA compliance rate. Response: delay triage so the clock starts late, or split one finding into several that each close fast.
- Target: scan coverage. Response: scan trivial repos and skip the hard ones.
- Target: zero findings in the pipeline. Response: loosen the scanner rules or add broad ignores.
- Target: training completion. Response: click through the content.
Design against it with paired metrics
Pair every target with a counter metric that gets worse if the target is gamed:
- SLA compliance with the count and age of exceptions.
- Fewer open criticals with reopen rate and the number of severity downgrades.
- Scan coverage with the share of assets that have an owner and a recent successful scan.
- Pipeline pass rate with the size of the ignore list over time.
If the counter metric is on the same dashboard, the trade is visible.
Keep some metrics as signals only
Not everything needs a target. Some numbers work best as instruments you look at without attaching bonuses or rankings. Exception counts, ignore list size, and time spent in each workflow stage are examples. Once you set a goal on them, they stop being honest.
Audit the data, not the people
Sample a few closed findings each month and check that the fix really shipped. Sample a few exceptions and check that the reason is still valid. Ten minutes of spot checking tells you more about metric health than another chart.
Do not compare teams
DORA notes that competing with other teams undermines the goal; the aim is to improve your own team over time. Ranking teams by open findings invites exactly the gaming above. Compare each team to its own history.
Quick check
Should we stop using targets entirely?
No. Targets drive action. Use a small set, pair each with a counter metric, and review whether the numbers still reflect real risk.
What is the quickest sign of gaming?
A sudden improvement in one number with no change in related ones, such as closures rising while reopens or exceptions also rise.
Sources
Last reviewed: 19 October 2026.
