50 percent of organisations now carry critical security debt, which is defined as flaws left open for longer than a year.