cyber investment prioritization