Weakness in Plain Sight — What Your Organization Is Telling Attackers