Identifying How Firms Manage Cybersecurity Investment