Almost two-thirds of UK businesses do not effectively control their internet security.