Companies have no idea how many contractors they have, and it’s a huge security risk