Most organizations had an unknown or unmanaged internet-facing asset exploited