Pair each speed metric with a safety metric that pushes back, so improving one cannot quietly damage the other. Good pairs include lead time with gate overrides, deployment frequency with change fail rate, and time to remediate with reopen rate. When a pair splits, investigate before celebrating.
Why pairs
DORA's guide warns against relying on one metric and recommends multiple metrics with some tension between them. It also notes that setting a metric as a goal invites gaming. A pair is the smallest structure that builds in tension: if one number can be improved by cheating, the other will show it.
Five pairs worth tracking
| Speed or output | Pushes back | A split looks like |
|---|---|---|
| Change lead time | Gate overrides and bypass count | Lead time drops because checks are skipped |
| Deployment frequency | Change fail rate | More deploys, more rollbacks |
| Time to remediate | Reopen rate | Fast closure of findings that return |
| Findings closed | Exceptions granted | Closure by waiver instead of fix |
| Scan coverage | Finding quality, such as false positive rate | Wider scanning that floods people with noise |
Pair one: lead time and overrides
If lead time improves by a day after a quarter, that sounds good. If gate overrides tripled in the same quarter, the gain may have come from bypassing a control. Report both next to each other. Our post on whether gates hurt lead time covers measuring the gate share.
Pair two: frequency and fail rate
DORA groups deployment frequency under throughput and change fail rate under instability. The point of that grouping is that you want both sides healthy. Rising frequency with rising fail rate means batches are getting riskier.
Pair three: remediation time and reopen rate
A short time to remediate is only good if fixes hold. If findings are closed by suppression or by a partial patch and then reappear, the reopen rate rises. Track the pair together.
Pair four: closure and exceptions
Counting findings closed rewards closing. A waiver also closes a finding. Show exceptions granted and their expiry dates beside closures so the mix is visible. See vulnerability exception metrics.
Pair five: coverage and quality
More coverage is good until the added noise causes people to ignore results. Track the share of findings judged false positives or not exploitable next to coverage.
How to use the pairs
- Put the two numbers in adjacent tiles, same window, same service.
- Write down the expected relationship before you look.
- When they diverge, ask for one example and read it.
- Fix the process, not the person.
Quick check
Can a pair itself be gamed?
Yes, with effort. Pairs raise the cost of gaming, and a periodic sample audit of raw items catches what remains.
How many pairs are too many?
More than five or six per service tends to go unread. Start with two and add one when a gap appears.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch the lifecycle of a finding and think about where closure could be real or only apparent.
How Safeguard fits
Safeguard offers policies, gates and dependency scanning, which produce the gate outcome and finding data used by these pairs. Try a free scan at gold.safeguard.sh/scan.
Sources
- DORA, DORA's software delivery performance metrics (misuse guidance): https://dora.dev/guides/dora-metrics/
Last reviewed: 19 October 2026.
