Study: Employers aware of cybersecurity threats but not proactive enough