Small- and medium-sized enterprises (SMEs) are leaving themselves vulnerable to security and compliance risks by not having internet acceptable use policies (AUPs) that address the latest and most dangerous internet-based threats, a new study has warned.