Nearly 1 in 4 middle market organizations reported a ransomware attack or demand in the past year.

81% of middle market organizations plan to increase cybersecurity spending in the year ahead, down from 91% the previous year.

Only 35% of middle market executives report using formal AI governance frameworks.

46% of middle market companies have data governance policies for AI.

46% of middle market companies use AI performance monitoring.

44% of middle market companies define roles and responsibilities for AI decision-making.

51% of middle market companies rely on staff training for responsible AI use.

96% of middle market executives express confidence in their cybersecurity posture.

39% of middle market organizations prioritize detection and response in cybersecurity investment.

Cybersecurity funding is managed by the chief technology officer in 43% of middle market firms, by the chief financial officer in 37%, and by the chief information security officer in 34%.

The most commonly outsourced cybersecurity services among middle market firms are cloud security management (50%), security awareness training (44%), security operations center services (43%), and risk and compliance management (41%).

23% of middle market organizations prioritize digital identity management.

36% of middle market organizations prioritize cloud security in cybersecurity investment.

35% of middle market organizations prioritize broader risk management functions in cybersecurity investment.

18% of middle market organizations experienced a data breach in the past year.

34% of smaller middle market companies noted that AI governance steps are not yet in place.

Only 46% of larger and 37% of smaller middle market companies reported collaborating with external partners for coordinated resilience planning.

Among middle market companies that experienced at least one ransomware attack, 31% said existing security measures were unsuccessful.

Familiarity with policy coverages dropped to 69% from 75% in the 2024 data at middle market organisations.

25% of surveyed executives at middle market organisations reported experiencing at least one ransomware attack or demand in the previous 12 months.