It's much easier to update systems than update people: http://www.techrepublic.com/article/how-to-make-your-employees-care-about-cybersecurity-10-tips/
Cybersecurity is ultimately about the bottom line, but ROI is a difficult measure. http://www.csoonline.com/article/3200270/network-security/cybersecurity-spend-roi-is-the-wrong-metric.html
Even more reasons to stay unplugged for a bit when on vacation. http://wspa.com/2017/06/17/stay-unplugged-while-on-vacation-cyber-security-expert-says/