Indian firms get serious about cybersecurity only when ‘attacked’, shows study