Andy Jaquith: Arguments over metrics are overstated, but to the extent they are contentious, it is because “metrics” means different things to different people. For some people, who take a risk-centric view of security, metrics are about estimating risk based on a model. A third camp that feels metrics should be all about financial measures, which brings us into the whole “return on security investment” topic. There’s also a fourth group that takes a look at the fracas and says, “I know why measuring things matter, but I don’t believe any of you are talking about””]
Source: https://taosecurity.blogspot.com/2007/09/hoff-interviews-andy-jaquith.html