Mid-market cybersecurity complacency: High confidence vs a sobering reality

Node4's latest research paints a concerning picture for mid-market organizations. A staggering 91% of C-Suite executives express confidence in their ability to tackle cyber-attacks, with over half of those expressing strong confidence. While this might sound reassuring, data from Unlocking Growth in the Mid-Market suggests this confidence may be misplaced.

A significant third of senior leaders are not actively addressing cybersecurity threats. Of those who are, 21% do not expect progress in the coming year, highlighting a disconnect between confidence and reality.

Despite their confidence, 53% of executives face security challenges within hybrid infrastructures. Alarmingly, only 36% have fully resolved data security risks tied to hybrid work, which involves secure remote access and zero-trust identity management. A third report cybersecurity skills shortages within their organisations and difficulty filling these positions.

According to Richard Moseley, CEO of Node4, "Many businesses routinely underestimate evolving cybersecurity risks such as AI-driven threats, vulnerabilities across hybrid networks, or the increased sophistication of supply chain attacks. Cyber criminals don’t stand still, and the C-Suite shouldn’t either." Moseley warns about the dangers of social engineering tactics and the need for C-suite leaders to prioritise cybersecurity.

The complacency of the C-suite is evident as cybersecurity ranks seventh among strategic priorities, trailing skills development, net-zero initiatives, and digital transformation. Although 29% indicate that cybersecurity threats most significantly influence their IT strategy, issues like sustainability and hybrid work are seen as more impactful.

Node4’s report suggests that this complacency might delay AI adoption. Over a quarter of executives view data security as the biggest challenge in their data strategy, vital for AI implementation. Furthermore, 40% see data security concerns as major hurdles to adopting AI.

In conclusion, Richard Moseley emphasises the link between low cybersecurity prioritisation and overconfidence. He states, "The low priority assigned to cybersecurity correlates with the inflated confidence levels noted in our report. It suggests senior leaders are shifting their focus to other pressing issues, underestimating their organisations’ vulnerabilities." The report warns that this attitude may heighten risks and stifle technological growth.

The report was conducted from 601 IT and Business leaders from sectors such as finance, private healthcare and manufacturing, among others. Each sector had proportional representation. The sample included Heads of IT, IT Directors, IT Managers, CIOs, CTOs, CEOs, CFOs, MDs, and Finance Directors from organisations with 500-5,000 employees and annual revenue between £100m and £1bn