The hidden cost of putting off security decisions