Security leaders should employ a combination of governance, culture and technology to measure their security program maturity.