Cybersecurity is considered a negative deliverable because:

It limits the possibility of negative fallout but produces no revenue

It limits the possibility that future positive gains can be made

It limits profits by increasing costs for cybersecurity defenses

It limits the possibility of both future negative fallout and the occurrence of positive gains