Today's security metrics support management practices rather than measure system capability to withstand attacks. This eliminates consideration of security features that are not currently used to manage systems as the basis for security metrics. Rather than judge security metrics by a utility standard with respect to current security management practices, they should instead be appreciated for proposing alternatives ways to identify security attributes that may or may not be of use in designing new security management practices. System capabilities such as adaptation to threat, proactive deterrence, and resilience to attack require system capabilities that may be measured using engineering methods for verification and validation of system function.