Limited security funding opens organizations to threat actors