Many firms have no idea how many devices are connected to their networks – a major cyber-security risk.