RSM US Cybersecurity Report Exposes Alarming Threats and New Protective Strategies

RSM US Cybersecurity Report Exposes Alarming Threats and New Protective Strategies

Summary:

• Fewer Breaches: 18% of middle market firms reported a data breach in the past year, down from a record 28% in the 2024 survey.
• Ransomware: 25% of executives reported at least one ransomware attack or demand in the past 12 months.
• AI Governance Gaps: 34% of smaller middle market companies said AI governance steps are not yet in place.
• Staffing Shortfalls: 33% of respondents have five or fewer data security and privacy employees.
• Cyber Insurance: 82% carry a cyber insurance policy, but only 69% are familiar with what it covers.

What the RSM Survey Found

The 10th annual RSM US Middle Market Business Index Special Report: Cybersecurity 2025, released April 17, 2025, with the U.S. Chamber of Commerce, found that 18% of middle market organizations suffered a data breach in the past year. That is down sharply from a record 28% in 2024. Yet 97% of executives said they felt confident in their current security measures, and RSM warned against complacency. The survey covered 402 U.S. middle market executives, interviewed in January 2025.

Why Breaches Fell, and Why That May Not Last

RSM suggested the drop may reflect a return to normal after a 2024 spike tied to sanctions and financial network disruption linked to the Russia-Ukraine conflict. “With the increasing complexity of attacks, it’s also possible that some companies may not have identified the presence of an attacker in their systems,” said Tauseef Ghazi, RSM’s national leader of security and privacy. He said continued vigilance is necessary as attackers use AI.

Bigger Firms, Bigger Targets

Larger middle market companies, those with $50 million to $1 billion in revenue, were twice as likely to be breached, with 24% reporting a breach compared with 12% of smaller firms.

Ransomware Remains a Major Threat

A quarter of executives reported at least one ransomware attack or demand in the past year, rising to 35% at larger firms versus 15% at smaller ones. Among companies hit, 31% said their defenses failed, 28% said they partly worked and 41% said they fully worked.

Staffing and Outsourcing

Qualified security staff are hard to hire and expensive to keep. A third of respondents have five or fewer data security and privacy employees. Many firms fill the gap by outsourcing: half (51%) outsource cybersecurity risk and compliance management, and 46% outsource incident response and forensics or their security operations center.

Spending and Insurance

Firms are still investing. 91% expect their cybersecurity budget to rise in the year ahead. Cyber insurance coverage hit a record 82%, up from 76%. But familiarity with what those policies cover fell to 69% from 75%, and to just 51% at smaller firms.

The AI Governance Weak Spot

AI governance is a soft spot, especially for smaller firms. Among smaller middle market companies, 34% said AI governance steps are not yet in place. Either they aren’t using AI yet, or they are using it without guardrails.

Canada Comparison

RSM also surveyed 101 Canadian middle market executives. Canadian firms were less likely to carry cyber insurance (68% versus 82% in the U.S.).

What Middle Market Leaders Should Take Away

Fewer breaches are good news, but RSM’s message is caution. Ransomware is still common and staffing is thin. For middle market leaders, the practical steps are to check what their cyber insurance actually covers, test ransomware recovery before an attack forces the issue and put basic AI governance in place while adoption is still early.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.