Plenty of US companies have egregious vulnerabilities