Looking for some guidance on security metrics that are actually insightful and would add value to the decision making process of a Fortune 500 company, I purchased this book. Unfortunately, I cannot say there is much in here that any educated Information Security individual would not know. The author does have a 5 page list of useful KPI's in chapter 3, but as mentioned before, any Info Sec professional worth his salt would be aware of these. Why the author needs another 300 pages is beyond my comprehension, as most of it is wasted with fluff and a review of college statistics class.