Cost was ranked as the biggest impediment to security, Winkler said.

Industries that have already seen how a major disaster can affect their bottom line are more likely to have a serious risk analysis models that take things like cybersecurity into account, said Eric Byres,] chief technology officer with Byres security, a critical infrastructure security consultancy. "What I'm seeing is that there is a real mix," he said. "Some companies are really on the ball... and then I see other companies that are very much in the dark, who don't get it."

The companies that are prepared for the next cyber attack are the ones that have buy-in from the bosses, Byres said. "It really gets driven from the upper management," he said.

The survey can be found (registration required).