We are a new team of about a dozen developers in our not-very-IT company tasked with reshoring/onshoring/insourcing (bringing into the company what a vendor has developed for us) a large (10M+ LOC?) legacy system. With pretty much zero documentation the approach we are taking is just to work on bug fixes as a way to learn more about the system.
Our management wants to keep track of our progress so they are counting the number of bug report tickets we've closed, which does not seem to be helping. Rather than addressing the highest risk vulnerabilities, the developers are focusing on finding the simplest bugs to fix while avoiding any in-depth troubleshooting.
What could be a better metric for us? There is an opinion that story points are more about new features and they do not really work well for defects, especially since we cannot really know the complexity of these in advance.
Maybe we need not a new metric but a new approach altogether.