Companies are fast to spot vulnerabilities but lazy to patch them, report