Organizations that use Windows New Technology LAN Manager (NTLM) are likely the most vulnerable to pass the hash attacks. This is because NTLM does not use some of the more advanced algorithms and encryption techniques that can help prevent these attacks.