Measuring protection: mission impossible?