Uncertainty is not the word organizations want associated with their IT security posture, but in many cases, the shoe seems to fit, a new study has found.