International study of 3,000 small businesses shows worrying widespread variations in cyber security readiness.