quantitative security metrics