At what point should you start investing money in cyber security?

The early days is all about survival - I get that. But how long do you actually put off cyber security? Obviously it can grow very expensive very quick, but I'm thinking more of something like a plug-and-play solution, that tells you the bare minimum fixes you should do to begin with. How long do you usually wait before getting started? What triggers the start? Is it investors, clients, compliance, fear of a breach?