Most small and medium-sized enterprises believe they are not at real risk of cyber attack, a survey has revealed.