Familiarity with policy coverages dropped to 69% from 75% in the 2024 data at middle market organisations.

25% of surveyed executives at middle market organisations reported experiencing at least one ransomware attack or demand in the previous 12 months.

51% of middle market organisations stated they outsourced cybersecurity risk and compliance management. Other leading functions outsourced include cyber incident response and forensics (46%), the security operations center (46%), security awareness training (44%), and vulnerability management (44%).

Ransomware cases accounted for over 90 percent of Sophos Incident Response cases for midsized organisations (from 500 to 5000 employees) in 2024.