security/vulnerability data with metrics

I work on software reliability and I recently encountered predictions by considering the testing data along with metrics such as execution time, CPU time, KSLOC etc. So, I was curious to learn if similar data collection is done in cyber security or vulnerability assessment. Because, National Vulnerability and other data bases only reports the number of bugs/vulnerabilities and the severity score but I have not seen metrics/measure based data. Any suggestions or information to help me learn more about this will be appreciated.

Thank you very much