Cyberinsurance And Risk Management Strategies

How much should an organization spend on cybersecurity? Should the organization buy cyberinsurance instead? Should it do both?