Cyber risk mitigation is a cost problem for not-for-profit organisations.