Firms lack responsible exec for cyber security