Global firms are surprisingly vulnerable to attack