A UK report highlighting a significant lack of understanding among directors of how cyber attacks can affect businesses has been dubbed "alarming" by a cyber security professional.