Report: Most agencies vulnerable to phishing