Only 17% of companies are effectively stopping cyberattacks and fixing breaches fast enough to reduce their impact — despite spending record amounts on security products and services — according to an Accenture report.

For its Third Annual State of Cyber Resilience, Accenture surveyed 4,644 executives representing companies with annual revenues of at least $1 billion. They came from 24 industries and 16 countries across North and South America, Europe, and Asia Pacific. Nearly all respondents (98%) were the sole or key decision maker regarding their organization’s cybersecurity strategy and spending.

The survey found that organizations are getting better at security basics with direct attacks down 11% compared to last year and security breaches dropped 27%. “I was pleased to see this, but a little surprised,” said report author Kelly Bissell, who leads Accenture’s global security business.

It also found that most companies, on average, spend 10.9% of their IT budgets on cybersecurity. And they are spending their money wisely investing in advanced technologies like artificial intelligence, machine learning, and automation. According to Accenture, 84% of organizations spend more than 20% of their cybersecurity budgets on tools that use these advanced technologies for detection and response. This is up from 67% of cybersecurity spending three years ago.

The study identified 17% of respondents as “leaders” that achieve significantly better results from their security investments than other organizations. These companies performed the highest in at least three of the following four categories: stop more attacks, find breaches faster, fix breaches faster and reduce breach impact.

Leaders, for example, were nearly three times less likely to have had more than 500,000 customer records exposed through cyberattacks in the last 12 months (15% versus 44%). They also find breaches faster, with 88% able to detect a security breach in less than one day on average. The remaining 12 percent said they were able to detect security breaches in seven days or less.

The report classified a second group, 74%, as “non-leaders” or average performers. Only 22% of non-leaders can detect security breaches with similar speed as the leaders. Most, however (78%), take up to seven days or more.

So the goal, Bissell said, became to ascertain “What did it mean? What made the difference between a leader and a laggard?”

Ultimately Accenture identified three key differences. First, leaders invest for operational speed. They prioritize how quickly they can detect a breach, how quickly they can mobilize their response, and how quickly they can get operations back to normal. Second, leaders scale, train, and collaborate more than non-leaders to increase the value of their security investments. And third, leaders place more emphasis on maintaining existing investments and performing better at security basics.

“The leaders, when they adopt a particular technology, they see it across their whole company and even down as far as their subsidiaries,” Bissell said. “Non-leaders may implement something, but only in a pilot or a very small faction of their company. They think they are secure, but they really are not because they haven’t covered everything.”

Bissell likens this to home security and locking the front and back doors as well as all the windows. Non-leaders may use a deadbolt on the front door but they leave the back door wide open. And this becomes increasingly important as 40% of security breaches are now indirect with attackers targeting the supply chain or business ecosystem instead of directly targeting the organization.

These types of indirect attacks “really trouble me,” Bissell said. “The bad guys are taking the path of least resistance because it’s harder to attack the company core. Instead of trying the front door, which is locked and bolted, let me go around back and see if one of their suppliers have weak security and see if I can get in that way. That’s what they are doing and being very successful at it.”

In fact, 83% of respondents agreed that they need to take steps to secure their ecosystems as opposed to only securing their own enterprises. Looking at a range of 17 different cybersecurity components — these span network security and threat detection all the way to staffing, security information and event management (SIEM), and event consoles — 60% reported cost increases across all 17 pieces over the last two years. And almost a quarter of respondents reported cost spikes of more than 15% a year across all 17. Looking ahead, 69% said the cost is unsustainable.

Meanwhile, most companies say that the cost of security technologies is becoming unsustainable.

The solution here is spending smarter, Bissell said. For example, gaps in protection remain a big problem for most companies — and represents a failing security investment. Non-leaders only have a little more than half (55%) of their organization protected by their security programs, the survey found. Leaders, on the other hand, cover 85%.

“The question is where do you spend the money to get the most out of your investment? We find those that spend not just at the corporate office but across the value chain” see better returns on investment from their security tools, Bissell said.

Security leaders also invest more in their people, he added. The survey found these top-performing companies were more than three times as likely to provide users of security tools with required training for those tools (30% versus 9%).

“They train their people, they even talk [about security threats] with their competitors and their partners,” he said. “This points to the fact that no one company can solve this on their own. Big companies realize the only way they can solve this is when they band together.”