Effective cyber-security should be considered an investment.