A report found that insufficient or ineffective cybersecurity training and resources are the two biggest items missing from a cybersecurity approach.