Here's what else the ISACA survey found:

The Increasing IoT Threat. The Internet of Things is an emerging threat, with 51 percent of survey respondents saying their organizations are at least concerned about IoT in the workplace. Meanwhile, the number of respondents for whom IoT is "on the organization’s radar" increased significantly over last year, ISACA found. Nearly all of the survey base – 97 percent – foresee a rise in IoT usage this year.

Ransomware is expanding, but the processes to address it are not yet ubiquitous. The number of malicious code attacks, including ransomware, remains high. More than three-quarters (78 percent) of respondents to the ISACA survey report that their enterprises experienced attacks in 2016 that included malicious software, and 62 percent report a ransomware attack specifically. But only 53 percent of the participants indicate that their enterprises have a formal process in place to deal with ransomware attacks.

Goodman believes that if businesses were more proactive in approaching security than reactive, security postures could improve.

"We need to change that mindset," he said. "There is a long way to go."