Most growing businesses have made real investments in cybersecurity but often still can't answer whether those investments are doing the job.