A counter metric is a second measure paired with a main one to catch the harm of over optimising it. If you push time to fix down, you also watch regression and revert rates. Pairing makes cheap gaming visible, because shortcuts that improve one number tend to worsen the other.
The idea
Any single measure can be improved in ways that defeat its purpose. Goodhart's law, in its common wording, says a measure that becomes a target ceases to be a good measure. Counter metrics do not remove the problem, but they raise the cost of cheating, since you would have to game two linked numbers at once.
Pairs that work in security
| Main metric | Gaming move | Counter metric |
|---|---|---|
| Time to fix | Merge hasty upgrades | Revert or rollback rate of fixes |
| Findings closed | Bulk close as accepted | Share of closures with evidence; exceptions past expiry |
| Scan coverage | Enable scans that report nothing | Findings per scanned asset, and last run freshness |
| Gate pass rate | Loosen the gate | Findings escaping to production |
| Alert response time | Close alerts quickly | Reopen rate, and incidents found late |
| Training completion | Click through | Repeat finding classes after training |
Notice that each counter metric sits on the other side of the trade off: speed against quality, quantity against evidence, strictness against flow.
DORA as a model
DORA's guidance pairs throughput measures with instability measures: change lead time, deployment frequency and recovery time on one side, change fail rate and deployment rework rate on the other. The page frames both groups as a way to understand delivery performance, so that speed is not read alone. The same logic suits security.
How to choose a counter metric
- Write the main metric and ask how you would cheat it as cheaply as possible.
- Identify what that cheat would damage.
- Pick a measure that rises or falls when that damage occurs.
- Check that the counter metric is hard to game in its own right.
- Put both on the same chart or tile so neither is read alone.
Rules of use
- Report them together, always.
- Set the target on the main metric and a guard band on the counter metric, such as "reverts must not rise."
- Review the pair quarterly, since people adapt.
- Do not stack too many. Two or three guards on a main metric are enough, otherwise the dashboard becomes unreadable.
An example in words
A team wants faster fixes. Median time to fix falls, which looks great. The revert rate on dependency upgrade pull requests rises over the same period. The pair reveals that upgrades are going out untested. Without the counter metric, leadership would have praised the trend.
When the counter metric moves first
Sometimes the guard metric worsens before the main one improves, as a team learns a new process. That is normal. Agree in advance how long a transition may last and what to review.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. You can run a free scan at gold.safeguard.sh/scan.
Quick check
How many counter metrics per main metric?
One to three. More than that makes the dashboard hard to read.
Do counter metrics prevent all gaming?
No. They raise the cost of gaming and make shortcuts visible. Review the pair regularly.
Sources
Last reviewed: 19 October 2026.
