Insider threat exaggerated, says study