Businesses should exercise caution when selecting security metrics and avoid relying solely on metrics promoted by specific vendors. Metrics should align with their security objectives and provide a comprehensive view of their security posture. Narrowly focused goals can limit the effectiveness of the security program. It is important to choose metrics that support the organization's overall security goals, regardless of whether they follow DevOps principles or not.