A flat cybersecurity budget doesn’t have to mean weaker coverage