This research aims to introduce a comprehensive framework to measure security of software systems. We plan to enhance the existing measurement approaches, which tend to focus solely on security metrics, by integrating critical human insights - the mental models of secure software development experts. By intertwining metrics and humans’ perception, we strive to overcome the hurdles of software security measurement that has long been considered a very hard, unsolvable problem.