Cybersecurity: how to make it pay