Cost of regulatory security compliance? On average, $3.5M