Firms believe they need to spend more on cybersecurity, finds EY survey