Middle Market Firms Increasing Proportion of Revenue Dedicated to Cybersecurity; Record High Percentage of Firms with Cyber Insurance

Middle market firms are increasingly dedicating a larger proportion of their revenue to cybersecurity, with the percentage of firms with cyber insurance reaching a record high, according to the RSM US Middle Market Business Index Special Report: Cybersecurity 2024. The report, presented by RSM US LLP in partnership with the U.S. Chamber of Commerce, highlights the ongoing threat of cybersecurity attacks, including emerging technologies such as generative AI.

The survey data from middle market executives revealed that 28% of companies reported experiencing a data breach in the last year, matching a record high set by the 2021 survey results. Smaller middle market firms saw breaches increase to 20% from 12%, while larger companies saw breaches rise to 37% from 28%. Despite the increase in breaches, 95% of respondents indicated confidence in their current security measures.

Tauseef Ghazi, national leader of security and privacy at RSM US LLP, emphasized the need for firms to remain vigilant and not become complacent in the face of cybersecurity threats. He emphasized the financial repercussions, reputational harm, and operational chaos that can result from cybersecurity events.

Ransomware attacks remain a significant concern in the middle market, with 30% of surveyed executives reporting at least one ransomware attack or demand in the last year. The report also highlighted vulnerabilities in third-party risk strategies as a common entry point for ransomware attacks.

The report also noted that 76% of middle market firms now have a cyber insurance policy, up from 68% the previous year. Executives are also increasing their understanding of these policies, with 75% indicating familiarity with their coverage.

While 37% of executives plan to increase the proportion of revenue dedicated to cybersecurity in the upcoming year, there are challenges in cybersecurity staffing. More than 60% of survey respondents reported having two or fewer data security and privacy employees, with larger companies having more dedicated internal staff compared to smaller businesses.

Overall, the report provides valuable insights into the cybersecurity landscape for middle market firms, highlighting the need for continued vigilance and investment in cybersecurity measures to protect sensitive data and ensure sustainable operations.