Most organizations are failing to update device operating systems and apps, leaving them vulnerable to threats