Just a weakly related comment here.

When one talks about security, it's really hard for people to follow what she really means; the context has always been qualitative, but not quantitative.

I found the idea "Vertical/Horizontal Attack Profile" interesting, which may help measure security when people argues different container solutions or even VMs.

https://blog.hansenpartnership.com/measuring-the-horizontal-...