Staying afloat on cyber compliance takes so much time and energy there's no room for actual cybersecurity analysis.