How organizations can focus cybersecurity investments