Cybersecurity cost-benefit analysis