Balancing Cybersecurity and Transferring Risk