For years, organisations have invested heavily in protecting systems, networks, applications and data.