Risk-based cybersecurity strategy