"Metrics should be related directly to business objectives," says Chris Morales, head of security analytics at Vectra. "How does operational process impact the company's ability to respond, and how does that relate to selling product in the market?"