In this presentation, we will see why security metrics are important and how they relate to risk management, if there are "good" and "bad" metrics and how we can visualize them. We will take an overview of the current state and resources available to security metrics. Finally, we will also attempt to find the most vital security metrics that can indicate the effectiveness of the overall security program of an organization.