More agencies plan to move to the security model in the next nine months, but a large number still have no plans at all.