Too often, organizations build cybersecurity strategies around new tools rather than the resilience of the business.