45 midmarket cybersecurity stats on growth, tools, and risk

Midmarket security teams are in an awkward spot. Big enough to be a target, with complex digital estates, significant revenue, and valuable data, but not big enough to operate like an enterprise security team. 

To find out what this actually looks like day-to-day, we surveyed 500 senior security decision-makers across the US and UK from companies with 400-6,000 employees across seven sectors: financial services, fintech, healthcare, manufacturing, professional services, retail, and SaaS. Here are the standout midmarket cybersecurity stats from The Security Middle Child report.

Growing estates, stretched teams

• 91% of midmarket organizations saw their digital estate grow over the past 24 months.
• 38% describe their digital estate growth as significant.
• 70% of organizations say headcount kept pace with estate growth.
• 30% grew headcount faster than their estate.
• 17% grew headcount more slowly than their estate.
• Nearly 10% kept headcount flat while their estate expanded.
• 42% of teams describe themselves as stretched, overwhelmed, or consistently behind.
• Professional services report the highest strain at 51%.
• Healthcare reports the lowest strain at 35%.
• 28% cite lack of visibility into what's exposed as a top operational challenge.
• 26% cite navigating too many security tools.
• 24% cite too many alerts with poor prioritization.
• 34% cite limited resources and competing priorities.
• 36% acknowledge their security posture hasn't scaled appropriately with digital estate growth.
• For 14%, the gap between their security posture and digital estate growth won't close for at least another six months.
• In healthcare, only 51% kept headcount at pace with their digital estate.
• In SaaS, 86% kept headcount at pace with estate growth.
• US organizations are more likely than UK counterparts to have grown headcount faster than their digital estate (36% vs 22%).

The Security Middle Child

How midmarket security teams are managing growth, complexity, and risk

get the report

Projecting confidence, but is it justified?

• 89% say their security budget is increasing.
• 94% of midmarket security leaders are confident in their ability to identify and remediate critical threats before attackers exploit them.
• 51% describe themselves as very confident in their ability to identify and remediate critical threats.
• 65% of C-level respondents say they're very confident in catching critical threats, that figure drops to 36% among middle managers, the people closest to the work.
• 51% say it would take approximately a week to assess their exposure to a critical zero-day, in a threat landscape where exploitation can follow disclosure within 24 to 48 hours.
• 18% are tracking internet-facing assets manually.
• 9% run multiple cloud environments without a unified view of security risk across them.

More tools, less clarity

• 44% of teams have either outgrown their stack or stitched it together from point solutions that don't provide a unified view.
• 49% cite AI and automation as their top investment priority for 2026.
• 33% are prioritizing adding new solutions.
• Only 17% are prioritizing increasing headcount.
• 41% report using AI pentesting.
• 20% cite the inability to measure and report on cyber hygiene as a top challenge.
• Cloud Security Posture Management (CSPM) is the only tool appearing in the top five most adopted tools across every sector surveyed.
• Healthcare tops CSPM adoption at 68%, well ahead of the next-highest sector at 56%.
• Attack Surface Management (ASM) ranks 10th for adoption, despite 28% citing visibility as a top challenge.
• Continuous Threat Exposure Management (CTEM) ranks 13th for adoption.
• Retail organizations cite lack of visibility as a top challenge more than any other sector (38%), yet only 27% use CTEM.
• Professional services tell a similar story: 35% cite visibility as a top challenge, but ASM adoption sits at just 26%, the lowest of any sector.
• 57% say their current security solutions are well aligned with their size and maturity.
• 46% say enterprise security platforms assume more staff, budget, or complexity than they can support.
• 45% say they're forced to combine multiple tools to compensate for gaps in their stack.
• 29% say tools designed for small businesses no longer meet their needs.

Cyber risk isn't reaching the boardroom

• Only 9% of midmarket organizations discuss cyber risk at board level.
• 34% discuss cyber risk with executive leadership.
• 51% keep cyber risk discussions at security or IT leadership only.
• UK organizations are more than twice as likely as US ones to take cyber risk to the board (14% vs 6%).

The Security Middle Child

How midmarket security teams are managing growth, complexity, and risk

get the report