Average business spends $15 million battling cybercrime