Organizations still ignoring a large piece of their cybersecurity defense