Whenever I have the opportunity to speak with county officials, I always acknowledge that resources are limited, and they are required to respond to many urgent requirements. Floods, tornados, snowstorms, windstorms, etc.
One thing I do point out is that cyber security is preventative. It is an investment to ensure you do not have to deal with an exponential cost later once you have been hit with a cyber attack. So budgeting for a small monthly amount is much better than the open-ended expense of a ransom, clean-up, recovery, replacement, downtime, etc. (This doesn’t touch the issues that come with the loss of data and loss of trust.)