What leaders underestimate about cybersecurity audit