Security managers are still failing to understand the risks associated with social networking sites.