Most companies lack incident response plans, others fail to test them and nearly half are not GDPR compliant, but some report improved security through automation, a study shows.