Engineer What You Can Control: The Input Metrics Advantage

Having led global cloud security initiatives at AWS and as a founder of a leading DevSecOps on AWS business, I've seen firsthand what works. Organizations that truly succeed don't just chase outcomes—they systematically engineer them.

In my years as a leader at AWS, I learned that focusing solely on lagging results is like steering a ship by watching the wake. By the time those output metrics signal a problem, you're already off course. Correcting course at this point becomes painful and expensive.

So, what's the lever that actually moves the needle? The real secret to building predictable, repeatable success is deceptively simple: obsess over what you can control. Implementing this with rigor, however, requires discipline.

This isn't just a catchy phrase. It's the operational discipline Amazon champions. It forms the foundation of every high-performing organization I've worked with or built.

In their book Working Backwards, former Amazon executives share their experiences. They describe how controllable input metrics become core drivers. When managed well, these lead to desired outputs. The authors also discuss this topic specifically in Input Metrics & Weekly Business Review.

I've embedded this principle deeply into the "Measure" phase of the AWS Partner Flywheel. This isn't academic theory. Identifying, instrumenting, and relentlessly tracking your true drivers creates sustained, scalable impact in cloud security and beyond.

Why Input Metrics Are Your Operational North Star

Too many organizations get stuck tracking only the outputs. Sure, metrics like monthly recurring revenue and customer satisfaction scores are essential. Project delivery timelines and security incidents detected post-deployment also matter. These tell you if you hit the mark.

But they are, by definition, lagging indicators. They only report on what happened. They don't give you the fidelity to manage in real-time. They can't help you make the daily and weekly decisions that prevent fires rather than just fighting them.

Input metrics are different. They are the quantifiable actions and critical activities in your processes. These directly cause outcomes. They are your leading indicators—what you and your teams can directly influence today.

As the 'Working Backwards' approach emphasizes, these factors positively improve customer experience. They create value and drive your desired results. They change before the output does. This gives you a crucial early warning system. It provides the tight feedback loop necessary for early course correction.

The Operational Difference: Input vs. Output

Think about it this way:

Amazon's Blueprint: Relentlessly Focus on the Controllables

At Amazon, this focus on controllable inputs isn't just a good idea. It's deeply embedded in the operational DNA. I lived the "Working Backwards" process firsthand.

You start with the desired customer outcome. Then you rigorously decompose it into specific, controllable actions and mechanisms. These actions produce the outcome you want.

This relentless focus on identifying and managing input levers separates high-performing teams from the rest. As a leader, you make deliberate decisions about resource allocation to drive these input metrics effectively.

Six Input Metrics That Move the Needle

Let's say your goal is a 50% reduction in customer security incidents. Instead of staring at incident counts, you might focus on these inputs:

• Proactive Design Reviews Conducted: Count of security design reviews per new feature.
• Automated Compliance Coverage: % of infrastructure under continuous compliance checks.
• Pre-Production Remediation MTTR: Mean time to fix critical vulnerabilities before release.
• Threat Modeling Coverage: % of critical systems with up-to-date threat models.
• Security Champion: % of two-pizza teams with a security champion.

Each metric is directly controllable, measurable in real time, and tightly correlated with reducing incidents.

Embedding Metrics into Your Rhythm

A Weekly Business Review (WBR) is a critical mechanism for this. Build your WBR around inputs, not outputs. Review trends in design reviews, compliance failures, and MTTR.

For a WBR template and example, visit this page.

Use that early warning system to adjust resourcing before lagging indicators turn red. Refocus engineering efforts proactively. This focus on the drivers is how you manage and shape outcomes effectively.

Instrumentation: Measure What Matters

If it matters, you can measure it. This is a core tenet. Start by decomposing fuzzy concepts into observable parts:

• Threat Modeling Effectiveness → # models completed, % services covered, time to backlog integration.
• Process Adherence → % of services that underwent mandatory security review.

Automate data collection wherever possible. Pull SAST results directly from CI/CD systems. Log review completions in your ticketing system. Track training via your LMS.

If you can't instrument a metric today, build the minimal system to capture it. Iteration beats perfection. Start with a proxy metric and refine over time. This practical approach ensures you're always making data-driven progress.

A Pre-Flight Checklist for Input Metrics

Before you lock in a metric, ask:

• Controllable? Can the team directly influence it?
• Correlated? Does it logically drive the desired outcome?
• Frequent? Can you report on it daily or weekly?
• Experiment-Ready? Can you test changes to see impact?
• Ownership? Is a clear owner accountable?
• Instrumentable? Can you reliably gather data?

If you can’t answer “yes” to most, decompose further or pick a different lever.

Final Thought: Your Inputs Define Your Future

Predictable success isn't an accident. In my career at AWS and advising global enterprises, success always follows a clear causal chain. The first and most critical link is what you're measuring and acting on right now.

The organizations that consistently scale and innovate manage controllable inputs with discipline. They adapt at speed by focusing on inputs. They don't just analyze the history presented by their outputs.

Don't drive by looking only in the rearview mirror. Focus on the road ahead by instrumenting and obsessing over the controllables. Build the right inputs. Review them relentlessly. The outcomes you desire will follow.

That's how we drove results at AWS. It's how you build a truly high-performing, predictable business.