Only 3 percent of external-facing servers in the world’s largest companies have been fully protected from the Heartbleed vulnerability, researchers found.