Why gathering data points about the health of your cybersecurity defences can lead to a conflict of interest, and ways to address this.