I have a personal, and I think (of course) the ultimate, information security metric: Mean Time Between Horrifying Discovery (MTBHD). While this may be self evident, there are some subtleties in the definition of MTBHD. The basic idea would simply be