Node4’s latest independent research reveals that 91% of mid-market C-Suite executives are confident in their organization’s ability to prevent and respond to cyber attacks — with over half expressing strong confidence. This might sound like good news, however, data from elsewhere within the same survey, Unlocking Growth in the Mid-Market, suggests that this confidence is misplaced. A third of senior leaders are not taking active steps to address cybersecurity threats, and, of those who are, 21% do not expect to make progress in the next 12 months.
Despite their confidence, 53% of C-Suite executives acknowledge facing security or performance challenges across their hybrid infrastructure. Worryingly, just 36% have fully resolved data security risks associated with offering hybrid work. This includes provisioning secure remote access to business systems and implementing zero-trust identity management. Furthermore, a third of executives report specific cybersecurity skills shortages and difficulty filling vacant positions within their organization.
“Many businesses routinely underestimate evolving cybersecurity risks such as AI-driven threats, vulnerabilities across hybrid networks, or the increased sophistication of supply chain attacks,” says Richard Moseley, CEO, Node4. “Cybercriminals don’t stand still, and the C-Suite shouldn’t either. They have a responsibility to ensure defences remain fit for purpose. But this won’t happen if cybersecurity complacency at the top spreads through the rest of the organization.”
He adds: “C-Suite leaders should also remember that attackers continue to use low-effort tactics, such as social engineering, to trick employees into sharing login information or approving MFA requests. They can also hijack valid sessions or use leaked data from breaches. These methods don’t require traditional hacking skills; they depend on exploiting oversights — sneaking in through metaphorical open doors. Recent retail sector breaches demonstrate that mid-market organizations cannot afford to be complacent about these types of threats either.”
Complacency is also evident in the relative importance that C-Suite executives give to cybersecurity. It’s ranked seventh out of a list of ten strategic priorities for the next 12 months — behind skills development, net zero, and digital transformation. And although 29% say that cybersecurity threats have the most significant external influence on their organization’s IT strategy, executives still think sustainability, hybrid working, and evolving regulations all have a greater impact.
Richard Moseley concludes: “The low priority assigned to cybersecurity correlates with the inflated confidence levels noted in our report. It suggests senior leaders are shifting their focus to other pressing issues, underestimating their organizations’ vulnerabilities. Our findings indicate that cybersecurity is now seen as operational hygiene — still important but no longer a competitive or strategic differentiator. This complacency could prove detrimental — increasing risk exposure and hindering adoption of new technologies that could drive efficiency and growth.”
Methodology
Unlocking Growth in the Mid-Market: The Node4 Report is based on a survey conducted independently and exclusively for Node4 by Censuswide. It reveals the views of 601 IT and business leaders across finance, private healthcare, retail, manufacturing, professional, and construction organizations – with an equal split across each sector.
