When nothing bad happened, how do you know if the cybersecurity money was well spent?