Security Metrics

http://www.securitymetrics.org

"Security Metrics - Replacing Fear, Uncertainty, and Doubt" by Andrew Jaquith - Addison-Wesley.

http://www.youtube.com/watch?v=dFsbqGJ3qEY - Security Metrics: A Beginner's Guide 

Vulnerability Scanners

Nessus
GFI LanGuard
Qualys
Rapid 7 NeXpose
Catbird (service)
Acunetix Web Vulnerability Scanner (detects SQL Injection, XSS, etc.)
Secunia CSI (Corporate Software Inspector - informs about missing patches for thousands of third party programs on Windows platform)
Retina
Microsoft Baseline Security Analyzer
CoreImpact
ISS Internet Scanner
Saint
McAfee - Foundstone
nCircle - IP360
Saint Corp – Saint
Critical Watch - Fusion VM
NeXpose
System Scanner-Assuria

http://www.netiq.com/products/vsm/default.asp
http://www.scmagazineus.com/Best-policy-management-solution/article/130876/
http://www.outpost24.com