Charities vulnerable to major security risks