Businesses should focus more on employees and company culture as they manage their cyber risks before they get too bogged down in the technology.