Threat of fines, not FUD, drives board decisions on cybersecurity spend