Risk Metrics: A Sad Story

Interested in risk metrics in IT security? Matthew Rosenquist on the sad story.
Having looked into this (in a cursory manner) for Job Stuff, I can relate to the multiple bodies with different, competing metrics.