Ninety-five per cent of staff completed their security training. It is the kind of number that ends a conversation. It looks like proof, it fits on a slide, and nobody in the room wants to be the one to poke at good news.
It also tells you almost nothing. Not whether anyone learned anything. Not whether a single person would spot a real attack on a bad day. It measures that people clicked to the end of something. And yet it sits in register after register, dressed up as a key performance indicator and defended with a green dot.
The question I keep coming back to, and I am still working out the full answer, is why we write numbers like that down and call it measurement.
Goodhart Is a Property of Targets, Not of People
You have probably met Goodhart's Law, even if not by name: when a measure becomes a target, it stops being a good measure. It usually gets told as a story about people. Set a target, and people optimise for the number instead of the thing behind it. The sales team games the call quota while the relationships rot. Staff click through the training while nobody learns anything.
Told that way, it sounds like a warning about human nature, and it pushes you toward a particular response: watch people more closely, add more checks, assume they will cut corners and design to catch them. That instinct is where a great deal of compliance quietly curdles into distrust.
But I think it misreads the law. The gaming is not the cause, it is the symptom. Goodhart only bites once you have decided that a measure is a target: something to be hit, cleared, reported green. The behaviour everyone frets about comes after a much earlier and much more casual decision, the decision to point a commitment at a number in the first place.
That is the shift that changed how I read it. Goodhart is not really a fact about people being weak. It is a fact about what targets do. So the place to deal with it is not people's behaviour. It is the choice of what becomes a target at all.
Signal, Target, and Noise
Before you decide whether something should be a target, decide whether it is worth measuring at all. Nate Silver's The Signal and the Noise is useful here. Most of what we collect is noise: numbers that are easy to gather and comforting to look at, and that carry almost no information about the real state of things. The signal, the reading that would actually change a decision, is rarer, harder to see, and usually buried under a heap of green dots.
A register is where noise goes to hide. Completion rates, ticket counts, percentages on track: most of it measures activity that is easy to count rather than outcomes that are hard to know. And the worst thing you can do with a noisy number is make it a target, because now you are committed to hitting a figure that meant nothing to begin with. Ninety-five per cent completion is the specimen: noise, promoted to a target, defended on a dashboard.
Sort an honest register and you find three things, not one. There is noise, which should simply be deleted. There are targets, real commitments you intend to hit, which are legitimate but gameable by nature, so you keep them few and choose them carefully. And there are signals, readings you are trying to understand rather than scores you are trying to beat. Almost every register I have seen treats all three the same, and quietly defaults the lot to targets, because a target is the only shape the form knows how to hold.
The Target Test
Here is the discipline I have landed on, at least for now, small enough to use this afternoon. For each measure, ask one question: am I trying to hit this, or understand it?
If you are trying to hit it, it is a target. Keep it, but sparingly, because every target is a fresh surface for Goodhart to work on. And be honest: if you would do nothing differently on missing it, it is not a target, it is noise, and it can go.
If you are trying to understand it, it is a signal, and it should not be scored. Write it as a question, not a threshold: "Do people recognise a phishing attempt when they are busy and stressed?" rather than "ninety-five per cent completion". Track a reading and a direction of travel, not a pass or a fail. Attach a target to a signal and you have turned the thing you wanted to understand into one more number to optimise, with a green dot to reassure you the whole way down.
If you are unsure which one you are holding, there is a quick check. Ask: could I hit this number while the reality under it got worse? If the answer is yes, it was never a target. It is a signal in a target's clothes, and it will lie to you in the most convincing way there is, quietly and on schedule.
None of this needs software. The sorting is something you can do with a pen. But it is also a design principle for the tools that hold a management system, and most of them know how to hold only targets, which is why understanding keeps getting flattened into a score the moment it is typed in. Some of what we are working on at Askara Solutions is simply letting a measure stay what it is, a commitment to hit or a signal to read, so the distinction survives contact with the system. The thinking comes first, though. The tool only ever inherits it.
It Is Not One or the Other
I should be honest about how I got here, because I did not start with a tidy rule. When I began pulling this apart, I was fairly sure the answer was that most of these numbers should have been signals all along, and that targets were the villain. Writing it through changed my mind. That is the same mistake stood on its head. A register with no targets in it is not more honest, it is just directionless. Some things genuinely are commitments, and a commitment has every right to a threshold and a red mark when you miss it.
What I actually landed on, somewhere between the first draft and this one, is that it was never a choice between the two. A healthy register holds both, deliberately. The problem was never that we had targets. It was that we had only targets, because nobody chose; the form chose for us. So the skill is not picking a side. It is staying awake to which kind you are holding, and refusing to let the default answer a question you never noticed you were being asked.
The Decision Nobody Debates
Come back to that ninety-five per cent. Nothing about the number has changed. What changes is that you can now see what it is: a noisy figure that someone, at some point, waved through as a target. Not because the staff clicking through the training were weak, and not because whoever wrote the module did a bad job, but because turning things into targets is the path of least resistance, and no one paused to ask whether this one had earned it.
Goodhart's Law was never really a warning about people gaming the system. It was a warning to whoever builds the system, about the numbers they choose to chase. You do not answer it by pushing people harder. You answer it, I think, by being a little more reluctant about what you ever agree to hit, and a little more curious about what you would rather simply understand.