Describir: Pragmatic security metrics