A composite metric combines several underlying metrics into a single value, usually through weighting. Security scores, maturity indices and risk ratings are all composites. They are popular with executives and treated with suspicion by the people who build them, mostly for good reasons.
One number instead of fifteen. It fits on a slide, it trends, and it gives a board something to hold onto.
Where a composite genuinely earns its place, it is because the underlying components are individually meaningless to the audience but collectively describe a condition the audience cares about.
Weighting is a judgement presented as arithmetic. Someone decided that patching matters 1.5 times as much as awareness training. That decision is embedded in every future reading and is almost never revisited.
Compensation hides problems. A composite can hold steady while one component collapses and another improves. The score says nothing changed. Something changed a great deal.
Direction becomes uninterpretable. When the composite falls three points, the immediate question is which component moved, which means the composite has sent the reader back to the components it was meant to replace.
Comparability across organizations is close to zero unless the weights and definitions are identical, which they are not.
Publish the components alongside the composite, always, in the same view.
Cap compensation. Set a floor on each component below which the composite cannot show green regardless of the others.
Keep the component count small. Beyond about six, individual movement stops being visible in the total.
Version the weights and record when they change. A weight change alters every historical value, which is a restatement whether or not anyone calls it one.
Never set a target on the composite alone. It is the most gameable object in a measurement programme, because there are as many routes to improving it as there are components.
If the audience can hold six numbers, give them six numbers. Composites are a compression tool, and compression is only worth its losses when the channel is genuinely narrow.
From the blog