Reframing investments in security as investments in the business