Risk-based security investment