RSM Report Finds Middle Market Firms Adopting AI Faster Than They Can Secure It

RSM found that middle market companies are adopting artificial intelligence faster than they are establishing cybersecurity and governance frameworks to manage it, according to a press release. The firm's 2026 Middle Market Business Index Cybersecurity Special Report shows that while confidence in cybersecurity remains high, actual controls and governance maturity are lagging behind AI adoption.

Only 35 percent of surveyed executives said their organizations use formal AI governance frameworks. Instead, most rely on staff training and partial controls such as data governance policies and AI monitoring. The report warns that this uneven approach increases exposure to unauthorized AI use, often referred to as shadow AI.

The survey of 501 executives revealed that 23 percent of companies prioritize digital identity management, even though identity-based attacks remain one of the most common entry points for ransomware and breaches. Nearly one in four organizations reported a ransomware attack or demand in the past year, and 18 percent experienced a data breach.

While 81 percent of respondents plan to increase cybersecurity spending in the next year, this represents a decline from 91 percent the previous year. The report also notes that middle market firms continue to rely heavily on third-party providers for services such as cloud security management, security operations, and risk compliance management.