The security middle child: why midmarket businesses are being left behind by the tools meant to protect them

Midmarket businesses occupy an uneasy position in the security landscape. Large enough to hold valuable data, run complex digital estates and attract serious adversaries, they have outgrown the tools built for smaller organisations, but are still  too lean to absorb the cost and complexity of enterprise platforms.

Exposure management firm Intruder, surveyed senior security decision makers at midmarket companies to find out what that gap looks like from the inside. Chris Wallis Intruder’s CEO and founder, explores what these findings, published in Intruder’s Security Middle Child Report, reveal about the midmarket’s threats and challenges.  

You framed midmarket businesses as the ‘security middle child.’ What challenges come with that label and why has this gap opened up?

There’s a common perception that middle children can feel overlooked between their older and younger siblings, and we feel the term captures something that many mid-size organisations have felt for years without having a name for it. 

These are organisations that have usually grown quickly, often through digital transformation or acquisition, and their attack surface has expanded accordingly. They’ve grown large enough to face similar cyber threats to larger enterprises but find they can’t access the level of solutions to match.

The vendor market has historically been built for two audiences. At one end is the Fortune 500, with dedicated security teams, substantial budgets and the capacity to absorb complex deployments, and at the other end are the smaller businesses, relying on more lightweight tools do the job. But there are a few tools available for the middle ground.

Our research found that nearly half of midmarket security leaders say enterprise platforms assume they have more staff, budget or complexity than they can support. At the same time, almost a third say the tools designed for smaller businesses no longer meet their needs. It’s not that they are failing to make good choices – the right choices have largely not been available to them.

Despite the challenges they face, you also found that midmarket security leaders are optimistic. What’s driving that confidence?

There’s a tendency towards misplaced confidence around cyber risk, but for midsize businesses, we saw some strong foundations for it. Generally, budgets are increasing and headcount has broadly kept pace with estate growth. Security is typically taken seriously, and investment reflects that.  

Still, confidence levels vary significantly depending on how close someone is to frontline security work. Among C-suite respondents, nearly two-thirds describe themselves as very confident in their ability to catch and remediate critical threats. Among middle managers – the people running the day-to-day operations – that figure drops to just over a third. 

The further you are from the coalface, the more confident you tend to be. It’s a significant gap because decisions about resources, tooling and aligning strategy to risk appetite are typically made at the top. 

This can be especially problematic when it comes to fast-moving threats. For example, half of the respondents told us it would take roughly a week to assess their exposure following a critical zero-day disclosure. In a threat environment where exploitation can follow disclosure within hours, that is a significant window. Recent developments like the launch Claude Mythos have shown just how fast the field is moving now and how the gap between exploitation discovery is shrinking quickly.

There were other notable gaps in capability, such as awareness of top operational threats and a tendency to track internet-facing assets manually. 

So, often, that sense of confidence comes from not knowing how under threat they really are.

Only nine percent of these organisations discuss cyber risk at board level. Why is the level so low, and what at the risks? 

It’s a reflection of the same issue we see in companies of all sizes.

Boards think in terms of business continuity, financial exposure and reputational consequence and, if cyber risk is not presented in those terms, it is easy for it to remain an IT problem rather than a business one.

There could be broader communication issues at play also. Security teams naturally tend towards the technical and have not always framed cyber risk in the language that boards respond to. When the conversation stays focused on vulnerabilities, tools and compliance metrics, it keeps cybersecurity boxed in as a technical issue rather than an operational one.

The size of the security team was a notable factor too, with larger departments having a better chance of making sure security issues are heard in the boardroom. 

We also found that regulations appear to be making a difference. Notably, the UK organisations in our research are more than twice as likely as their US counterparts to have that conversation at the board level. Stricter regulatory pressure in the UK and its proximity to the EU mean that frameworks like NIS2 and the FCA’s cyber resilience requirements create a structural reason for boards to engage. That suggests the conversation can be moved, but that it often takes external pressure to move it.

Enterprises of all sizes are turning to AI and automation to bridge the resource gap. Is that the right approach for the midmarket?

Many teams in mid-size organisations are under genuine pressure with fast-growing digital estates and tech stacks becoming more complex and fragmented. If AI can help a lean team accomplish more with the same resources, that’s a very compelling proposition.  

As a result, our research found that nearly half of midmarket security leaders cite AI and automation as their top investment priority for 2026. However, it needs to be done carefully. Four in ten already describe their security stack as either outgrown or fragmented, and layering AI capabilities onto a shaky foundation compounds the problem rather than solving it. 

There is also a question of accessibility. AI pentesting, for instance, appears to be gaining traction, but adoption is heavily skewed towards larger organisations with bigger teams and more resources. For the smallest and most stretched midmarket teams, the tools that promise the most relief remain out of reach or add complexity they cannot absorb. 

There’s a lot of potential here, but for AI to genuinely serve the midmarket, it needs to be built with those teams in mind from the outset.