UK firms say £6.6bn annual security testing cost too high