Enterprise Cybersecurity Solutions: A Complete Guide for Modern Businesses

Modern enterprises depend on interconnected applications, cloud services, remote employees, APIs, mobile devices, third-party vendors, and increasingly artificial intelligence. That connectivity creates enormous business opportunities, but it also expands the number of places attackers can target. Protecting an organization therefore requires much more than antivirus software and a firewall around the company network.

Enterprise cybersecurity solutions are technologies, processes, services, and security strategies designed to protect large organizations against cyber threats. They can cover identity, endpoints, networks, cloud environments, applications, email, sensitive data, third-party access, incident response, threat detection, backups, and security governance. The strongest programs combine several layers instead of relying on one security product.

The goal is not to create an organization where an attack can never happen. That expectation is unrealistic in a complex digital environment. Effective enterprise security aims to reduce the likelihood of successful attacks, identify suspicious activity quickly, limit what an attacker can reach, protect critical information, and help the organization recover without allowing one incident to become a business-wide crisis.

In 2026, that broader approach matters more as enterprises adopt multi-cloud infrastructure, SaaS applications, generative AI, automation, connected devices, and distributed work models. Cybersecurity has consequently become an enterprise risk issue involving executives, technology teams, security professionals, employees, suppliers, and business leaders rather than a responsibility belonging only to the IT department.

What Are Enterprise Cybersecurity Solutions?

Enterprise cybersecurity solutions are security capabilities designed to protect an organization’s complete digital environment. Instead of focusing on one laptop or application, enterprise security considers thousands of users, devices, workloads, servers, databases, networks, applications, identities, and external connections that may operate across several countries and technology platforms.

These solutions typically include identity and access management, endpoint security, network security, cloud security, data protection, security monitoring, vulnerability management, application security, threat intelligence, incident response, and disaster recovery. Larger organizations may also require specialized solutions for operational technology, industrial systems, APIs, containers, software development environments, and privileged accounts.

Technology represents only one part of the solution. Businesses also need cybersecurity policies, risk assessments, employee awareness, incident-response procedures, vendor management, security testing, governance, and clearly assigned responsibilities. Buying sophisticated tools without establishing processes for using them effectively can create a complex security environment that still leaves important gaps.

Enterprise security is therefore best viewed as a coordinated system. Identity tools decide who should have access, endpoint solutions watch devices, security platforms collect suspicious activity, cloud controls protect workloads, and incident-response teams investigate potential attacks. When these capabilities share useful information and support a common risk strategy, the organization becomes significantly more resilient.

Why Enterprise Cybersecurity Is More Important Than Ever

Digital transformation has changed the traditional enterprise perimeter. Employees may access company applications from offices, homes, hotels, airports, customer locations, or personal networks. Business data may be stored across multiple cloud platforms and SaaS services rather than inside one company-owned data center protected by a clearly defined network boundary.

Attackers have adapted to this environment as well. Instead of always attempting highly technical network intrusions, they may steal credentials, impersonate employees, exploit unpatched software, compromise vendors, misuse legitimate remote-access tools, or convince help-desk employees to reset an account. The identity of a user can therefore become as important a security boundary as the physical network.

Ransomware remains another major reason enterprises need layered protection. A successful attack can interrupt business operations while attackers steal data, encrypt systems, or threaten to publish sensitive information. Backups remain essential, but organizations also need identity protection, segmentation, endpoint detection, vulnerability management, monitoring, and rehearsed incident-response procedures.

Cybersecurity is also connected directly to customer confidence and business continuity. A serious breach may disrupt services, expose confidential information, require expensive investigations, and create regulatory or contractual consequences. Enterprise cybersecurity solutions therefore protect more than computers; they help protect the organization’s ability to operate, serve customers, maintain trust, and pursue digital growth.

Zero Trust Security Is Becoming a Core Enterprise Strategy

Traditional enterprise security often relied heavily on the idea of a trusted internal network. Once a user or device passed through the perimeter, systems could sometimes assume that activity inside the network was relatively safe. Modern cloud environments and distributed workforces have made that assumption increasingly difficult to justify.

Zero trust security takes a different approach. Access decisions are based on factors such as identity, device condition, requested resource, context, risk, and organizational policy rather than trusting someone simply because they are already connected to the corporate network. Users receive the access required for legitimate work without automatically receiving broad access to unrelated systems.

Identity, devices, networks, applications, workloads, and data all become part of the zero-trust architecture. A company might require stronger authentication for sensitive applications, confirm that a device meets security requirements, restrict privileged access, segment critical systems, and continuously evaluate suspicious behavior rather than making a single trust decision at login.

Zero trust is not a product that an enterprise buys once and installs everywhere. It is an architectural approach that develops gradually as identity management, segmentation, device visibility, policy enforcement, application security, analytics, and automation improve. Organizations should therefore establish priorities based on business risk rather than attempting to transform every system simultaneously.

Identity and Access Management Protects the New Security Perimeter

Identity and access management, commonly called IAM, determines who can access enterprise resources and what those people or systems are allowed to do. Modern IAM platforms can combine authentication, single sign-on, authorization, lifecycle management, conditional access, directory services, and identity governance to create a more consistent approach to enterprise access.

Multifactor authentication is one of the most important identity controls because a stolen password alone should not automatically provide access to sensitive company resources. Enterprises increasingly prioritize stronger authentication methods, particularly for administrators, remote access, high-value systems, email accounts, financial applications, and other environments where account compromise could create significant consequences.

Access should also follow the principle of least privilege. An employee working in marketing usually does not require the same permissions as a database administrator, while a temporary contractor may need access only to one application for a defined period. Limiting permissions reduces the amount of damage that a compromised account or malicious insider can potentially cause.

Privileged access management adds another security layer around administrative and high-risk accounts. Enterprises can control how privileged credentials are issued, monitor administrator sessions, provide temporary access, and remove excessive standing privileges. This approach recognizes that protecting the accounts capable of changing systems is especially important because attackers frequently seek higher privileges after gaining initial access.

Endpoint Security Protects Laptops, Servers and Devices

Endpoints remain one of the largest enterprise attack surfaces. Employee laptops, desktops, servers, mobile devices, and specialized systems connect people directly with business applications and data. If one endpoint becomes compromised, attackers may attempt to steal credentials, install malware, access files, or move toward other systems.

Traditional antivirus primarily searches for known malicious files, while modern endpoint detection and response, or EDR, provides broader visibility into endpoint behavior. EDR platforms can detect suspicious processes, unusual commands, malicious activity, privilege escalation, and other behaviors that may indicate a compromise even when traditional malware signatures are insufficient.

Enterprise endpoint security can also include device encryption, host firewalls, application control, configuration management, patching, mobile device management, USB restrictions, behavioral detection, and device posture assessment. The appropriate controls depend on how devices are used and the sensitivity of the resources they can reach.

Strong endpoint security also requires accurate asset visibility. Organizations cannot effectively protect devices they do not know exist. Enterprises should therefore maintain reliable inventories, identify unsupported operating systems, remove unnecessary software, manage updates, and understand which devices are connecting to sensitive applications and networks.

XDR and MDR Help Enterprises Detect Threats Faster

Large organizations generate enormous amounts of security information from endpoints, identities, networks, cloud services, email platforms, and applications. Examining each source independently makes it difficult for analysts to understand when several small signals actually represent different stages of the same attack.

Extended detection and response, commonly called XDR, aims to connect security signals across multiple parts of the technology environment. For example, a suspicious login followed by unusual endpoint behavior and unexpected cloud activity may become much more meaningful when those events are correlated instead of being treated as three unrelated alerts.

Managed detection and response, or MDR, adds human expertise and managed security operations. An MDR provider may monitor security environments, investigate suspicious activity, perform threat hunting, prioritize incidents, and help customers respond to attacks. This can be particularly useful for enterprises that lack enough experienced analysts to maintain continuous internal monitoring.

Neither XDR nor MDR should be selected simply because the acronyms are popular. Enterprises should examine data coverage, integrations, response capabilities, threat-hunting expertise, alert quality, automation, service availability, retention, and responsibilities during an incident. The best solution is one that improves actual detection and response rather than simply creating another security dashboard.

SIEM and Security Analytics Provide Centralized Visibility

A Security Information and Event Management system, or SIEM, collects and analyzes security-related data from multiple sources. Logs from identity platforms, servers, applications, firewalls, cloud services, endpoints, databases, and other systems can be centralized so security teams have a broader picture of activity across the organization.

SIEM platforms can help identify suspicious patterns that would be difficult to recognize by reviewing individual systems manually. An administrator logging in at an unusual time, followed by sensitive database queries and large data transfers, may generate separate events. Centralized analytics can help connect those activities into a security investigation.

Modern SIEM platforms increasingly incorporate automation, behavioral analytics, threat intelligence, and machine-learning capabilities. However, collecting more logs does not automatically improve security. Enterprises need to understand which data sources matter, how long information should be retained, which detections are useful, and who will respond when the platform raises a meaningful alert.

Poorly configured monitoring can overwhelm security teams with unnecessary notifications. Successful enterprises therefore prioritize detection engineering and continuously improve alert logic based on actual threats. The objective is not to create the largest volume of alerts but to provide analysts with timely, actionable information that helps them investigate potentially harmful behavior.

Cloud Security Must Cover More Than the Cloud Provider

Enterprise cloud adoption introduces a shared-responsibility model. Cloud providers protect significant portions of the underlying infrastructure, but customers remain responsible for many elements involving identity, configuration, applications, data, workloads, permissions, and how cloud services are actually used.

Misconfiguration can create serious exposure. An accidentally public storage resource, overly broad identity permissions, exposed credentials, vulnerable cloud workload, or insecure application interface may provide attackers with opportunities even when the cloud provider’s underlying infrastructure remains secure. Cloud security therefore requires continuous visibility rather than assumptions that moving a system to the cloud automatically makes it safer.

Cloud-native application protection platforms, cloud security posture management, workload protection, entitlement management, container security, and infrastructure-as-code scanning can help enterprises identify weaknesses across cloud environments. Organizations using several cloud providers may particularly benefit from centralized visibility because security policies can otherwise become fragmented between platforms.

Cloud security should also be incorporated into development workflows. Security checks performed before deployment can identify risky infrastructure configurations, exposed secrets, vulnerable dependencies, and insecure container images earlier. Fixing problems during development is often easier than discovering them after a production application becomes accessible to customers and attackers.

Data Security Protects the Information Attackers Actually Want

Networks and devices are valuable largely because of the information they provide access to. Customer records, financial data, intellectual property, employee information, business plans, authentication secrets, source code, and confidential communications may all be attractive targets. Effective enterprise security therefore needs to focus directly on protecting sensitive data.

The process begins with understanding what information the organization actually holds. Data discovery and classification solutions can help locate sensitive information and assign appropriate categories. Without that visibility, businesses may apply expensive security controls to low-risk information while failing to adequately protect critical datasets stored in unexpected locations.

Encryption can help protect information while it is stored or transferred, while access controls determine who can view or modify it. Data loss prevention technologies can identify and restrict certain forms of sensitive-data movement, although rules need careful design to avoid disrupting legitimate business activity.

Enterprises also need policies for data retention and deletion. Keeping information indefinitely can increase the amount of material exposed during a breach while creating unnecessary storage and governance challenges. Organizations should understand why information is retained, how long it remains necessary, where copies exist, and how sensitive data can be securely removed when no longer required.

Ransomware Protection Requires Prevention and Recovery

Ransomware defense cannot depend on one security product. Attackers may enter through stolen credentials, exposed remote services, phishing, vulnerable applications, compromised vendors, or other pathways. Enterprises therefore require a combination of identity controls, endpoint protection, network segmentation, patching, monitoring, email security, and user awareness.

Backups remain essential because an organization needs a realistic way to recover critical systems if production environments become encrypted or damaged. Backup strategies should include protected copies that attackers cannot easily modify or delete, and restoration procedures should be tested rather than assumed to work when an emergency occurs.

Segmentation can reduce the ability of ransomware to move freely between systems. Critical environments should not automatically be reachable from every endpoint or account. Restricting unnecessary connections and privileges helps prevent a compromise in one part of the organization from immediately becoming a company-wide operational problem.

Incident-response plans should also address ransomware before an attack occurs. Leadership needs to know who makes decisions, which systems are restored first, how internal and external communication works, when legal or regulatory teams become involved, and how evidence is preserved. A rehearsed response is considerably more useful than a document nobody has tested.

Vulnerability Management Reduces Preventable Security Gaps

Enterprise environments continuously change. New applications are deployed, software dependencies receive updates, employees install tools, cloud resources appear, and vendors disclose vulnerabilities. Vulnerability management provides a structured process for identifying, evaluating, prioritizing, and correcting weaknesses before they can be successfully exploited.

Scanning every system and generating thousands of findings is not enough. Organizations need risk-based vulnerability management that considers whether an asset is internet-facing, how critical the system is, whether exploitation is known or likely, what data is accessible, and what compensating controls already exist.

Patch management remains an important part of the process. Enterprises should establish responsibilities and timelines for applying security updates, particularly when vulnerabilities affect exposed or business-critical systems. Legacy applications may require alternative protections when immediate patching is impossible, but the remaining risk should be understood rather than ignored.

Asset management supports the entire vulnerability program. A security team cannot patch a forgotten server, assess an unknown cloud workload, or remove unsupported software it does not know exists. Reliable inventories therefore provide the foundation for both vulnerability management and broader enterprise cybersecurity.

Application Security Protects the Software Business Depends On

Enterprises increasingly create their own applications, APIs, integrations, scripts, and internal platforms. Security problems introduced during development can expose sensitive information or create pathways into other systems. Application security aims to identify and reduce those weaknesses throughout the software development lifecycle.

A secure software development lifecycle, or SSDLC, integrates security into planning, coding, testing, deployment, and maintenance rather than treating security as a final inspection before release. Developers can receive secure-coding guidance while automated tools help detect vulnerable dependencies, coding weaknesses, exposed secrets, or insecure configurations.

API security has become particularly important because APIs connect mobile apps, cloud services, business partners, customer platforms, and internal systems. Enterprises should understand which APIs exist, who can access them, how authentication works, what data they expose, and whether unexpected activity can be detected.

DevSecOps takes this concept further by integrating automated security controls into development and delivery pipelines. The goal is not to make developers responsible for every cybersecurity problem. Instead, security teams provide reusable guardrails and tools that help development teams build secure products without creating unnecessary delays.

Third-Party and Supply Chain Security Is Now Essential

Modern enterprises depend heavily on external technology providers, consultants, managed service providers, cloud platforms, software vendors, payment systems, logistics partners, and other suppliers. Those relationships improve business efficiency but can also introduce cyber risk when external organizations receive access to systems, data, or operational processes.

Third-party risk management should begin before a contract is signed. Enterprises can evaluate what information a vendor will handle, which systems it can access, what security practices are in place, how incidents will be reported, whether subcontractors are involved, and what happens to company information when the relationship ends.

Software supply-chain security requires similar attention. Applications may contain numerous third-party libraries, packages, development tools, and components that organizations did not create themselves. Businesses need processes for assessing important dependencies and responding when weaknesses emerge within software they rely on.

In 2026, supply-chain cybersecurity is becoming more structured rather than remaining a simple vendor questionnaire exercise. Enterprises increasingly need due diligence, risk-based supplier segmentation, contract controls, access monitoring, software visibility, and ongoing assessments. Third-party security works best when it becomes part of procurement and enterprise risk management rather than an isolated annual compliance task.

AI Is Changing Enterprise Cybersecurity on Both Sides

Artificial intelligence creates new cybersecurity opportunities as well as new risks. Security teams can use AI-supported tools to analyze large volumes of activity, summarize incidents, assist threat hunting, identify patterns, automate repetitive investigations, and help analysts understand complex security information more quickly.

Attackers can also use AI to improve phishing messages, automate research, create convincing impersonation attempts, and accelerate certain stages of malicious activity. Enterprises should therefore prepare employees for social-engineering attempts that may be more personalized and linguistically convincing than traditional poorly written phishing emails.

Organizations deploying their own AI systems face another security challenge. AI applications may connect to confidential datasets, internal documents, external tools, APIs, and business workflows. Security programs need to consider who can access these systems, what information users can submit, where prompts and outputs are stored, and how models interact with sensitive resources.

The enterprise challenge is therefore threefold: secure AI systems, use AI responsibly for cyber defense, and prepare for AI-enabled attacks. AI should not be treated as a completely separate security universe. The strongest approach integrates AI risk into existing identity, data protection, application security, monitoring, governance, and incident-response programs.

Email Security and Human Risk Still Matter

Even the most advanced enterprise technology cannot remove the human element from cybersecurity. Employees routinely receive emails, collaboration messages, password-reset requests, invoices, shared documents, and customer communications. Attackers exploit those normal workflows because convincing a person can sometimes be easier than breaking a well-secured technical system.

Enterprise email security can help identify malicious attachments, suspicious links, impersonation attempts, spoofed domains, and other threats before messages reach users. However, automated filtering will never be perfect, particularly when attackers send carefully targeted messages that contain no traditional malware.

Security awareness should therefore teach practical decision-making rather than simply require employees to complete an annual presentation. People should know how to report suspicious messages, verify unusual payment requests, identify unexpected authentication prompts, and respond when someone pressures them to bypass normal processes.

Organizations should also avoid treating employees as the weakest link while simultaneously creating confusing systems. Security teams can reduce human risk by making secure behavior easy: provide password managers, strong authentication, straightforward reporting tools, clear procedures, and responsive support. Good cybersecurity combines human awareness with systems designed to prevent individual mistakes from becoming major incidents.

Network Security Still Has an Important Role

The disappearance of the traditional perimeter does not mean networks no longer matter. Enterprises still need to protect office networks, data centers, cloud connections, remote access, branch locations, industrial environments, and communication pathways between applications. The difference is that network location alone should no longer determine trust.

Modern network security may include next-generation firewalls, network detection and response, secure web gateways, DNS protection, segmentation, intrusion prevention, VPN alternatives, and secure access service edge technologies. These controls can help restrict malicious traffic while improving visibility into communication between systems.

Segmentation is particularly useful because it limits the pathways available to an attacker. Financial systems, development environments, production workloads, employee devices, and critical infrastructure should not necessarily communicate freely with one another. Restricting unnecessary traffic reduces both accidental exposure and opportunities for lateral movement.

Network telemetry can also complement endpoint and identity information. A compromised device may behave normally at the operating-system level while making unusual connections to external infrastructure. Combining network, endpoint, cloud, and identity signals gives security teams a more complete understanding of potentially malicious activity.

Cybersecurity Governance Connects Security With Business Risk

One of the most important developments in enterprise cybersecurity is greater emphasis on governance. Security teams cannot make every risk decision independently because cybersecurity choices affect budgets, operations, legal obligations, product development, customers, and strategic priorities. Senior leadership therefore needs meaningful visibility into cyber risk.

Governance defines responsibilities, priorities, policies, oversight, and accountability. Executives should understand which business services are most critical, what cyber risks could seriously interrupt them, which risks have been accepted, and where additional investment is required. Security metrics should support decisions rather than simply report large numbers of blocked attacks.

A mature governance program also connects cybersecurity with enterprise risk management. A manufacturing company may prioritize production continuity differently from a bank protecting financial transactions or a healthcare organization handling clinical systems. Enterprise cybersecurity solutions should therefore reflect what the organization actually needs to protect rather than copying another company’s security stack.

Boards and executives do not need to become security engineers, but they do need enough information to govern risk effectively. Security leaders should communicate cyber issues in terms of business impact, likelihood, resilience, and strategic tradeoffs instead of expecting decision-makers to interpret highly technical alerts or vulnerability scores.

How to Choose Enterprise Cybersecurity Solutions

Start with risk rather than a vendor catalog. Identify critical applications, important business processes, sensitive data, high-risk identities, external exposure, regulatory obligations, and realistic threats. This creates a much stronger foundation than purchasing several popular cybersecurity tools and hoping they collectively provide adequate protection.

Next, assess existing capabilities. Large enterprises often discover they already own overlapping security features across cloud subscriptions, endpoint platforms, identity tools, network products, and enterprise software. Adding another solution may increase complexity without creating enough additional protection to justify the operational burden.

Integration should be a major selection factor. Security products that share identity context, endpoint information, alerts, threat intelligence, and automated response can reduce investigation time. An isolated tool may technically perform well while still making the security program harder to operate because analysts must continually move data between separate consoles.

Finally, evaluate usability, scalability, support, implementation requirements, reporting, automation, data retention, deployment model, compliance needs, and total cost of ownership. The best enterprise cybersecurity solution is not always the product with the longest feature list. It is the solution that effectively reduces meaningful risk while the organization’s team can realistically operate it.

Building an Enterprise Cybersecurity Strategy Step by Step

Begin by understanding the business. Identify critical services, important information, major technology dependencies, and the consequences if those resources become unavailable or compromised. This ensures cybersecurity priorities reflect business impact rather than simply following whichever technical issue receives the most attention.

Next, establish a security baseline covering identity, asset management, patching, endpoint protection, backups, logging, email security, data protection, network controls, and incident response. Mature organizations can then layer more advanced detection, automation, threat hunting, cloud security, privileged-access controls, and application-security capabilities onto that foundation.

Create measurable improvement targets rather than attempting to achieve perfect cybersecurity. An enterprise might prioritize phishing-resistant authentication for administrators, reduce critical vulnerability remediation time, improve backup restoration testing, expand endpoint coverage, or increase visibility into privileged accounts during a defined planning period.

Finally, continuously test assumptions. Conduct tabletop exercises, restore systems from backups, test incident escalation, review access permissions, assess vendors, simulate attacks, and examine whether security alerts actually reach people capable of responding. A cybersecurity strategy becomes valuable when controls perform effectively during real operational pressure rather than only looking complete in documentation.

The Future of Enterprise Cybersecurity Solutions

Enterprise security is moving toward greater integration. Organizations have accumulated large numbers of separate security tools, which can create overlapping alerts, inconsistent information, and administrative complexity. Platform consolidation may continue where it improves visibility and operations, although specialized products will remain valuable for particular security challenges.

Identity is also likely to become increasingly central. As applications move to cloud services and employees work from different locations, verifying users, devices, workloads, APIs, and machine identities becomes essential. Security programs will increasingly focus on determining who or what is requesting access, why it needs access, and whether the request still appears trustworthy.

Automation and AI will play larger roles in security operations, particularly where analysts face overwhelming volumes of telemetry. These technologies can assist investigation and prioritization, but organizations will still need human judgment for ambiguous incidents, business-risk decisions, adversarial behavior, and responses that could interrupt critical operations.

Most importantly, enterprise cybersecurity will continue moving from prevention alone toward cyber resilience. Organizations should still work hard to prevent breaches, but they must also be prepared to detect compromises, contain attackers, maintain essential operations, restore systems, communicate effectively, and learn from incidents when preventive controls fail.

Final Thoughts on Enterprise Cybersecurity Solutions

Enterprise cybersecurity solutions provide the technologies and processes organizations need to protect users, applications, devices, cloud infrastructure, networks, and sensitive data from increasingly complex cyber threats. However, no single firewall, endpoint platform, SIEM, or AI security product can provide complete enterprise protection by itself.

The strongest security architectures use layers. Identity controls restrict access, endpoint platforms watch devices, network controls limit movement, cloud tools protect workloads, data security protects valuable information, and detection platforms help identify suspicious behavior. Backups and incident response provide resilience when preventive controls cannot completely stop an attack.

In 2026, governance, zero trust, identity security, ransomware resilience, cloud protection, supply-chain risk, and AI security should all be considered within the broader enterprise security strategy. Organizations do not necessarily need every available cybersecurity product, but they do need clear visibility into their risks and a deliberate plan for managing them.

Ultimately, effective enterprise cybersecurity is not about owning the most security tools. It is about creating a manageable, risk-based system that helps the business operate confidently. When people, processes, technology, and leadership work together, cybersecurity becomes an enabler of digital growth rather than simply another technical expense.

What are enterprise cybersecurity solutions?

Enterprise cybersecurity solutions are technologies, services, and processes that protect an organization’s users, networks, devices, cloud systems, applications, and data from cyber threats, breaches, ransomware, and unauthorized access.

What are the most important enterprise cybersecurity solutions?

Important solutions include IAM, MFA, EDR/XDR, SIEM, cloud security, network security, vulnerability management, data protection, email security, backups, privileged access management, and incident-response capabilities.

What is zero trust in enterprise cybersecurity?

Zero trust is a security approach that does not automatically trust users or devices based on location. Access is continuously evaluated using identity, device, context, risk, and least-privilege principles.

How does AI affect enterprise cybersecurity?

AI can help security teams analyze threats, automate investigations, and process security data faster. It can also create new risks through AI-enabled attacks and enterprise AI systems that require their own security controls.

How should a company choose an enterprise cybersecurity solution?

Businesses should start with their most important assets and risks, evaluate existing tools, identify security gaps, and compare solutions based on protection, integration, scalability, usability, support, and total operating cost.