I think it's even more interesting to look at what kinds of threats IT departments aren't worrying about. Low on the list of concerns: phishing, electronic vandalism and electronic extortion. All three make for sexy headlines, when it happens. But, there is clearly a feeling of "it won't happen to me" judging by the results.
Let's hope this isn't a case of denial that leads to a case of denial of service.