What Questions Should I Keep in Mind to Improve My Security Metrics?