Companies lack IT security funding