Definition drift is what happens when the formula behind a metric changes over time without anyone recording it. The name on the chart stays the same. The thing being measured does not.
It is distinct from metric drift, where the value moves because the world moved. With definition drift the world may be unchanged and the number moves anyway.
Rarely by decision. Almost always by accumulation.
A vendor is replaced and the new tool counts assets differently. A scanner changes its default severity mapping in a minor release. An analyst adds a filter to exclude a noisy subnet and does not write it down. A subsidiary is acquired and enters the denominator four months after it entered the business. A field gets renamed and the query silently starts returning fewer rows.
Each change is small and locally sensible. Together they mean the number reported this quarter and the number reported two years ago are answers to different questions.
A wrong number gets caught. Someone notices the figure is implausible and it gets fixed.
Definition drift produces plausible numbers. The chart looks fine. The trend looks meaningful. Decisions get made on a comparison that was never valid, and the error compounds every period it goes undetected.
It also tends to surface at the worst possible moment: during an audit, a regulatory examination, or a board challenge, when someone finally asks how the earlier figure was calculated and nobody can say.
Store the formula version with every computed value, not just the value.
Flag any change in method as an event on the time series, so a step change in the chart can be checked against a step change in the definition.
When a source system is replaced, recompute an overlap period both ways and compare before you connect the two segments.
Treat a formula change as a restatement, the way finance would. Reprocess the history under the new definition or mark the break clearly. Do not do neither.
Metric Maestro keeps metric definitions versioned and separate from the tools that feed them. The formula lives in the platform, not in a query somebody wrote against a vendor API.
When a source tool is swapped, only the mapping between that tool and the underlying fact records changes. The metric definition is untouched, so the series stays comparable across the transition. Every stored value carries the definition version it was computed under, which makes drift visible instead of silent.
From the blog