@topo.pal - started listening to How to Measure Anything in Cybersecurity Risk and was thinking that (or the original How to Measure Anything: Finding the Value of Intangibles in Business) could help you with your metrics problem. Have you looked at either of those books yet?