For chief information security officers (CISOs) and their organizations, the question is not if the cybersecurity budget should be cut. It's how much risk they are willing to take.