Security metrics are hard. But that doesn't mean you should ignore them. In fact, a lot of teams are measuring the WRONG things which leads them down a path where efforts are being spent in areas that aren't driving to their bigger goals.