For journalists, cyber-security training slow to take hold