34% of smaller middle market companies noted that AI governance steps are not yet in place.

Manufacturing organisations experienced 24% of attacks involving data theft.

The share of successful phishing compromises has declined steadily from 46% in 2022 to 29% in 2023 to now just 25% of all incidents remediated by X-Force in 2024.

The number of vulnerabilities has increased rapidly over the past eight years and grown threefold.

Only 46% of larger and 37% of smaller middle market companies reported collaborating with external partners for coordinated resilience planning.

Nearly one in three attacks observed by X-Force used valid accounts.

Among middle market companies that experienced at least one ransomware attack, 31% said existing security measures were unsuccessful.

25% of attacks exploit public-facing applications.

30% of the incidents X-Force responded to in 2024 involved the exploitation of public-facing applications.

Familiarity with policy coverages dropped to 69% from 75% in the 2024 data at middle market organisations.

51% of middle market organisations stated they outsourced cybersecurity risk and compliance management. Other leading functions outsourced include cyber incident response and forensics (46%), the security operations center (46%), security awareness training (44%), and vulnerability management (44%).

25% of surveyed executives at middle market organisations reported experiencing at least one ransomware attack or demand in the previous 12 months.

Canadian middle market firms are less likely to have cyber insurance coverage than U.S. companies (68% versus 82%).

41% of respondents at middle market organisations said their existing security measures were completely successful against ransomware attacks.

Early data from 2025 suggests an even greater increase of 180% of weekly infostealer volume compared to 2023.

52% of respondents at middle market organisations said they are developing communications plans for crises or disruptions.

97% of surveyed executives at middle market organisations reported feeling confident in their current security measures.

Reported middle market breaches fell significantly after reaching a record-high of 28% in the 2024 survey.

Larger middle market companies were twice as likely than smaller middle market companies to suffer a breach in the past year.

The number of middle market firms that reported carrying a cyber insurance policy reached a record-high of 82%, up from 76% a year ago.