Investment: to allocate money in the expectation of future benefit, so that could mean administrative expenses, which would cover and include a lot (but not all) spending.
My vote would be on invested.
Both sides are right. If the company is never hacked, then it could both validate the security model as well as give a reason why not to bother in the first place. If the software runs smoothly throughout development (give or take a bug here and there), then all that testing was indeed a waste of time.
The difference between investment and cost is the ability to look into the future and analyze the past.
So there really isn't a straight answer.
EDIT: it also matters to the perspective of those outside of the organization. A bullish analyst might call Alphabet's moonshot projects an investment, while a bear would likely label them a cost.
in your example, even if the security-driven development generates value by preventing a hack, it could simply be considered Cost of Goods Sold, or maintenance costs...
In accounting standards, Investment turns into an asset.
-> CCTV system = investment -> security guard = cost
they both generate value by increasing security and the dinstinction is not related to their usefullness for the company.