Cyber resilience has been treated as an insurance line item, something you fund to avoid a bad outcome.