Bang for the buck – calculating the ROI of cybersecurity