You can buy better tools, but that alone won’t get you to perfect cyber security