Several panels and talks have addressed the metrics problem from a variety of angles. The consensus is that there just simply isn t enough good data available in most parts of the industry. Microsoft, which has been looking at this problem for several years, doesn’t have a clear answer. The last few years have seen a marked increase in the amount of data avilable on some topics, especially data breaches, but those are still the exceptions rather than the rule. Even the organizations doing the best job with those programs have a tough time getting the most out of their measurement efforts.
Source: https://threatpost.com/experts-call-better-measurement-security-042209/72562/