security investment prioritization