Less than 17 percent of applications in leading organisations carry security debt, compared with more than 67 percent in lagging ones.