Businesses should look at the structure of their organization if they want to prepare for cyber attacks,” says researcher.