Everyone says security metrics are important, but many companies are still failing to gather and apply meaningful metrics that inform decisions and drive action. Metrics can be used to demonstrate the efficacy of security operations. This is often a starting point. As security governance matures, metrics need to be strategically aligned and answer questions that execs have.