Organisations must make bold decisions to build a robust security position for the future