Cybersecurity should be seen as an investment, not an expense