Cyber risk management is not just a function of how much you spend on the technology solutions to protect your data.