Employers who allow freedom of web use are not educating their staff about online risks.