Indeed, Cybersecurity is a challenge of resource optimization. People, process, technology as MITRE advocates in its SOC implementation guide. With adversarial approach in mind. I fully support your viewpoint.
The business dimension could be a 4th, supported by processes, which is itself supported by people and technology.
Cyber risk management should guide this resource optimization.