Firms still leave security to chance