The New York Times had a piece about operations research and its use in  football. An excerpt:

Just as it is in baseball sabermetrics, context is crucial to Schatz’s analysis. Schatz rates every play a team runs by comparing it with the league average performance for plays in as close to that situation as possible. In Schatz’s analysis, the relative success of a play is determined by, among other things, the down and distance, the current score, the field position and the opponent’s strength. DVOA, in short, is an attempt to create a tool of analysis for football similar to such Jamesian baseball statistics as offensive winning percentage, runs created and OPS (on-base percentage plus slugging percentage).

This work, as with Bill James’ sabermetrics work in baseball, is inspiring to me – I believe we can do something like it in security. Note that the key in DVOA is a relative measure – perfect for security risk.