Weak cyber protections lead to personal, institutional risk