Is risk a good security metric?