Wise men say: If you cannot measure, you cannot improve.

Take for example the anti-virus metrics. If the number of virus detected last month was 20,000 and this month it is 30,000 - should the management celebrate the effectiveness of their anti-virus software and leave it at that?

Increased number of virus detected can be a good thing because the anti-virus has caught more viruses. At the same time it could be a bad thing because it could be indicative of email spam(and/or virus) filtering software has become weak because of the increased sophistication of the attack. May be many systems were left unpatched from a recent vulnerability.

The %increase or %decrease in the numbers does not mean much unless you take the holistic view of the whole security scenario.  The trick is getting out of the trap of numbers.