Most security pros say their culture is 'just average'