Cybersecurity: which strategy works?