Companies say they care about security, but don’t pay as much