Does it make sense to benchmark security?

Case study about security benchmarking