Four in 10 Scottish firms are not prepared for a cyber attac