Bad security hygiene still a major risk for enterprise IT networks