Is data security a bank’s biggest cost center, and if not, what usually is?

Data security surely is an expense. It comes in many shapes and forms. It is a category under the overall Risk & Compliance umbrella (which I think is the biggest expense). However data security is also an expense because it hinders a lot many innovative steps a bank could take but does not due to the lack of being 100% confident about data security.