The requirement is that businesses make this sum as small as possible:
It is convenient to give this requirement a name. Call it the risk management goal.
If a business fails to meet this goal it most likely either spends too much or too little money on defense.