Our take... While many talk about "investing in security", the reality is there is no strategic competitive advantage (for most businesses).
One of the most telling things that are directly counter to everything we're hearing in the cyber security industry is - Security is a cost of doing business. It's not a strategic, competitive advantage. It's something that every company has to employ.
To be working in a remote environment, as we all are today in October 2020, you have to have basic security controls in place. You cannot invest in them as something that will give you an advantage over your competitor, because everyone's got to do this.
It's not just your company, but it is the supply chain in which you're working, your suppliers, your partners, and your customers. If you work with a particular company and they get breached by a hacker stealing their passwords... - What happens? They are now coming at you - and will look like the company. This can get really tricky, really quickly.