Poor metrics can render a well-intentioned security operation centre entirely ineffective.