Despite the headlines and repeated warnings, a recent survey suggests businesses still need to learn security lessons the hard way.