Responding to email-based attacks takes over three hours, on average