Reducing the human cost of your security metrics

Creating metrics without first understanding and reducing the human cost of your security metrics creates a blindside to what we’re actually trying to measure and influence. Here’s how to avoid those mistakes.

"Sir, I can take you over here."

The soft, inviting voice came from a gentle man standing in the self checkout aisle. As I made my way over, Sammie - as it read on his nametag - greeted me with a warm smile. Recognizing I was now in the self checkout aisle, I offered to handle it myself. Sammie refused. His rhythmic approach moved the groceries across the scanner and seamlessly into bags.

"Looks like you've done this a time or two, " I complimented. That started our conversation.

I learned that Sammie has worked for the same company for just shy of 31 years. He got his start as a bagger (think back 30 years to what that must have been like). From there he worked as cashier, in customer service, accounting, and then eventually back to checkouts, but as a floor manager. He had clearly seen and experienced a lot during those three decades.

Given the smile on his face as he hummed and greeted people, I asked him if he still liked his job.

He paused for a second. His voice changed. Sammie looked me square in the eye and said, “It’s getting harder.” He explained that employees today are expected to do more than at any point in the last 30 years. It doesn’t always lead to better outcomes.

As evidence, he pointed monitor hung from the ceiling. It displays 3 large, yellow circles, each with a number. Clearly a metric, Sammie explained, “The bubbles control what we do."

I asked if they helped. After all, if we measure the right things, they should help guide decisions and lead to better outcomes. He shrugged. With a sole focus on the numbers, sometimes that meant the customer experience comes second.

That's the rub of metrics: they impact people. Those who are judged by them and the people they serve. When we don’t take that into the account, sometimes our metrics don’t quite hit the mark we were trying to measure.

Understanding the human cost of metrics

A key driver of a metrics program is a method to gauge progress. Done right, it demonstrates the value of our work. Metrics are also used to guide actions and direct resources. That places a focus on looking for distilled ways to rapidly report on current status.
Sometimes that hyperfocus creates a blindside to the ways our metrics impact the work of others. When the focus of the number outweighs other factors of the work and customer experience, we have to question if we solved or created a problem.

Taking the human cost of metrics into account means first understanding how the metrics we capture and use impact how people do their jobs. The best way to learn is through direct experience. Witness and observe the metrics in action. Prepare to ask questions.

Reducing the impact on people by building the right metrics

Here are a few ways to work with people to minimize the human cost while building a robust and successful metrics program:

  • Observe and ask: start by observing how people work. Consider how the collected metrics support or otherwise impact their actions. Then ask people what they think; often when the people affected are given a chance to contribute, their experience benefits everyone.
  • Explore the context: where and how are the metrics collected? Consider the ultimate goal(s) (for example, positive customer service at a checkout) and if or how the metrics support or could impact the goal(s) in unexpected ways (creating stress and a terse experience)
  • Consider the story: what story needs to be told about how people and the organization are doing? How do the selected metrics support the story?
  • Confirm the approach: once the initial metrics are collected, get back in the field to observe how they work, what they represent, and what you might have missed the first time
  • Look for improvement: come back and check on the metrics again on periodic intervals; in some cases, it takes time for the program to take hold and for people to consider how the metrics drive action.

When assessing the impact metrics have on people, it is easy to fall into the trap of looking to simply confirm the metric is right. Instead, place a focus on people and look for unintended consequences and actions that happen as a result. Use what is learned to focus on measuring what matters and develop the right metrics from that. The successful approach is less about being right from the start and instead finding the right way that benefits everyone.

Good people find a way

After loading the car with my groceries, I walked the cart back to the front of the store. When I got near the door, I heard Sammie's voice ring out, "sir!" I turned my head, curious why he was calling out. Then I realized he was chasing after a couple that just walked out the door, a bag they forgot in his hand. They were clearly grateful and thanked him for his help. I have no idea if that was good or bad for the bubbles, but it was precisely perfect for customer service.

It confirmed that good people find a way to do the right thing, regardless of the metrics. Our opportunity is to recognize and encourage more of that.

Cybersecurity market research: Top 15 statistics for 2017