Half of companies don’t know if their security is working