TIM Lecture Series Cybersecurity Metrics and Simulation

Given the continual onslaught of successful cyber-attacks against banks, governments, and retailers, one has to wonder whether any progress is being made in computer security at all. How is it possible to reconcile the huge investments that have been made in securing networks and computers with the fact that attackers are still routinely breaching what should be highly protected networks? What metrics can explain the situation and how can we evaluate those metrics through simulation or other means?