Companies are increasingly concerned they will not get better at defending against sophisticated attacks