Metrics, decisions & economics

Numbers that change a decision, and the many that do not.

22 sketches

• Goodhart's lawA candle under the thermometer
• McNamara fallacyThe gauge decides what exists
• AveragesThe mean sits well below the tail
• Base ratesRare breaks the arithmetic
• Cost of controlsOnly the top line got costed
• Cost of incidentsFour studies, one incident
• Decision thresholdsDraw the line before you read the dial
• False precisionTwo decimal places, one shrug
• Leading indicatorsUpstream and downstream
• Loss expectancyA guess times a guess
• ProbabilityRare is not never
• Risk quantificationThe number stands on its guesses
• Security scorecardsGraded from the pavement
• UncertaintyTwo different not knowings
• Security competes for finite organisational attentionEverything else is on the same bench
• Security spend should follow risk concentrationThe same trickle everywhere
• Security creates option value during incidentsThe siding was laid years ago
• The cheapest control can be removing the featureUnbolt it and the rest goes too
• Security debt is borrowed future effortStill tied on
• Executive decisions need ranges, not false precisionMeasure the width
• Security strategy means not protecting everything equallyYou only have so much fence
• A control can cost more than the risk it reducesThe bill is longer than the loss