How Can I Effectively Measure Improvements in Container Security?

I'm facing a challenge in demonstrating the effectiveness of our container security initiatives to leadership. While vulnerability numbers may dip for a short time, they often spike again with new CVEs. Although our mean time to remediate looks good, it doesn't account for the numerous false positives we deal with. The board is eager for concrete proof of our progress, but I'm questioning whether we're tracking the right metrics. Total CVE counts seem misleading since many aren't exploitable in our setup, and compliance rates show more about our documentation skills than actual security. We've worked hard to reduce our attack surface, but quantifying that in a way that makes sense to non-technical executives is tough. They want hard numbers, but simply stating we've removed unnecessary packages doesn't cut it. I'm looking for metrics that reliably showcase real security improvements and reflect our engineering efforts without manipulating the data.