First step: define metrics

Its critical to define metrics to know if we're doing a better job- whether its for securing a company network or the country infrastructure