66% of organisations that do not alert employees to update at-risk credentials say they lack the tools or resources to do so effectively.