Write a security key result as a change in exposure, speed or coverage that you can measure from a system, not as a count of things you did. "Run four trainings" describes effort. "Cut the median age of critical findings on public services" describes a result. Pick a few, measure them from tooling, and review them honestly.
The activity trap
Activity is easy to count, so it fills the page. Number of scans run, policies written, trainings held. These show that people were busy. They do not show that anything got safer, and a team can hit all of them while risk grows.
A useful test: if the number went up and risk did not change, would you notice? If not, it is an activity measure.
Three shapes of good key result
- Exposure. How much of a bad thing exists. Open critical findings on internet facing services, secrets found in repositories, accounts with standing admin rights.
- Speed. How fast you respond. Time to remediate a critical finding, time to revoke a leaver's access, time to detect a test intrusion.
- Coverage. How much of the estate is under a control. Share of repositories with dependency scanning, share of services with an owner recorded, share of production access behind multi-factor authentication.
Each should have a starting value, a target and a date. If you do not know the starting value, the first key result is to measure it.
Example objectives
Objective: customers can trust how fast we fix serious problems.
- Reduce the median time to fix critical findings on public services from the current figure to a target set after you measure it.
- Raise the share of services with a named owner to a stated level.
Objective: a stolen credential does less damage.
- Remove standing admin access for most engineers in favor of time-limited elevation.
- Rotate or retire the long-lived keys on your inventory list.
Fill in your own numbers from your own baseline. Targets copied from another company are fiction for yours.
Avoid gaming
Any target invites optimization. If you reward fewer open findings, someone may close findings without fixing them. Pair a count with a quality check, such as sampling closed items to confirm they were resolved. For more on this effect, see Goodhart's law and security metrics.
Keep the number small
Two or three objectives with two or three key results each is plenty. Security work often has a long tail of necessary routine tasks. Those belong in the maintenance bucket of your plan, not in OKRs, which should highlight the changes you are choosing to make.
Review like a scientist
At the end of the cycle, ask what moved, why, and whether the measure was a fair proxy. A key result that was easy to hit was probably set too low. One that was missed may reveal a real constraint worth raising with leadership. Either way, the review teaches you more than the score does.
Quick check
Is "complete security awareness training" a good key result?
It is an activity. Use it as a task under a result such as fewer successful phishing reports reaching users, measured from your own data.
What if I do not know the baseline?
Make measuring it the first key result, then set the target next cycle from the real number.
Last reviewed: 19 October 2026.
