Middle Market Breach Rates Match the 2021 Record
The RSM US Middle Market Business Index Special Report: Cybersecurity 2024, developed with the U.S. Chamber of Commerce, reports that cyber risk remains a significant operational concern — particularly as generative AI expands the attack surface. Despite sustained warnings, many middle market companies continue to exhibit complacency that undermines their data protection posture.
Breach Rates and the Complacency Gap
- 28% of middle market executives reported a data breach in the past year — matching the 2021 record.
- Smaller firms: breach rate climbed to 20% (from 12%).
- Larger firms: breach rate rose to 37% (from 28%).
- 95% of respondents nonetheless expressed confidence in their existing security infrastructure.
The gap between actual incident rates and reported confidence is the core finding: companies feel protected at a rate wildly inconsistent with how often they are actually breached.
A U.S. Chamber of Commerce official framed recent federal cybersecurity policy as an effort to rebalance responsibility and realign incentives for corporate cyber defense.
Ransomware and Third-Party Risk
Ransomware pressure remains high:
- 30% of executives reported at least one ransomware attack or demand within the past year.
- 64% regularly audit third-party cybersecurity controls.
- Nearly 60% incorporate cybersecurity service-level agreements into vendor contracts.
Investment Trends
Companies are increasing cyber investment, though staffing gaps persist:
- Cyber insurance adoption: 76% (up from 68%).
- 37% of executives plan to expand cybersecurity spending proportionally.
- More than 60% operate with two or fewer dedicated data security personnel.
The full report covers digital identity strategy, cloud migration, and preparedness across multiple industries, based on 403 respondents surveyed January 8 – February 16, 2024.
Implications
For middle market CFOs and audit committees, the actionable finding is the confidence-to-reality gap. Self-assessment of security posture is not a reliable indicator — independent testing and realistic incident simulations are. Third-party risk, now tied to 60%+ of incidents in many data sets, warrants explicit contractual and monitoring discipline beyond a standard SLA clause.