Your EDR shows detections. Your scanner shows vulnerabilities. Your awareness platform shows completions. Each one is right about its own slice, and none of them answers the questions you actually manage by: is response getting faster, is patching keeping pace with discovery, is training reducing clicks?
And half the program never touches a tool at all. Exercises, audit findings, budget, renewals, headcount — they live in spreadsheets and inboxes, rebuilt by hand for every review, with numbers that change depending on who compiles them.
Managing security this way means steering on instinct. The function that changes fastest is the one measured worst.