For passwords, for example, it is common to calculate the time needed to brute force all possibilities.
The time taken also depends on the hardware used. Brute forcing scales very well and by investing more in hardware the time to crack a password can be reduced. Typically, top of the line consumer hardware is used to calculate the time, but the scrypt paper for example takes a reverse approach; it lists the costs of a machine while limiting the time:
This does not really indicate the overal security, as it only assumes a brute force attack. The security of an algorithm may be compromised in other ways. This is usually notated by the reduction in work needed to perform some action. For example, to calculate a MD5 to match another MD5, 2128 computations are normally needed. With a certain preimage attack, only 2123.4 calculations are needed.