Many organizations have started, staffed and subsequently abandoned security metrics programs. Yet, as organizations become increasingly data-driven, they return in attempt to quantify and analyze security and operational assets and processes to remain vigilant to risk. Many strategies are touted as the right strategy for security metrics, but what does a successful metrics program actually look like? Maureen Niemiec describes critical capabilities of a next-generation security program — definition, analytics, action — and outlines technologies and processes to provide a value-added program that can pinpoint risk and potentially provide predictive analytics.