38% of organizations are at risk of critical exposures due to a combination of security shortfalls.