Traditional metrics can be valuable, but they don’t tell the whole story. To truly understand the bigger picture of an organization’s security posture, leaders need to consider “culture metrics.”