Evangelizing Metrics: Computer security is a field that, unfortunately, is very difficult to quantify. How do we know what works, and what doesn't? The answer, unfortunately, is "generally, we don't." Because we don't keep metrics. In this largely math-free presentation I will try to get you excited about security metrics.