Solving the current risk versus the uncertain future risk? An example from cybersecurity