Companies lag in I.T. security plans