Defending against sophisticated cyber threats requires structural isolation, sandboxing, and process lockdown rather than larger compliance budgets