Knowing your processes are being completed isn’t as important as knowing they’re effective. Unfortunately, many CISOs are trained to look at metrics that don’t matter. As a general rule, all metrics can provide insight, but if they don’t help you make decisions they’re not useful.