Middle Market Sentiment Report: How firms are protecting growth with cybersecurity investments
Middle market firms are protecting the gains they’ve created. As leaders scale AI and sharpen productivity, latest Middle Market Sentiment survey data reveals they’re also increasing investments in cybersecurity as fraud threats remain widespread.
The latest findings from 731 owners and senior executives show that 92% of firms expect to increase cybersecurity spending over the next 12 months. Those plans come as roughly two in three companies were impacted by at least one incident in the past year, led by a rise in business email compromise (BEC) attacks.
For leaders, growth and protection go hand in hand. As firms pour resources into AI and technology, protecting those investments becomes increasingly important.
Below are three key takeaways from the data, each paired with a brief deep cut.
1. Fraud exposure holds steady, but BEC climbs
Overall fraud risks stayed flat compared to Q4 2025 as 66% of companies experienced a fraud or cybersecurity incident in the past year. The largest jump in incidents came from BEC, affecting 41% of companies, up from 36% in the last wave.
BEC happens when criminals impersonate trusted partners to redirect payments, often by hijacking threads or spoofing domains to request a change to ACH or wire payment instructions. Companies counter with account verification tools, dual authorization on payments, authentication practices, and staff procedural training.
Other risks held steady or eased: data corruption (31%), check fraud (23%), ransomware (23%), and identity theft (22%). With risk spread across so many categories, disciplined controls and consistent verification remain the foundation of strong defenses.
Deep cut: Business email compromise affects some industries more than others. Technology (50%) and business and professional services (49%) reported the highest incident rates, both topping the 41% average.
Business email compromise is one of the costliest threats to midsized companies. The pattern is simple: A known vendor’s email is impersonated, and the fraudster requests to ‘update’ payment instructions. The strongest defense is a disciplined process. Always authenticate the request through a known contact before making any payment changes.
John Carney
Head of Operational Risk
KeyBank Commercial
2. Cybersecurity spending aligns with confidence and may help create it
How companies feel about the year ahead shapes how they plan to invest. Firms with an excellent or very good outlook are far more likely to plan moderate (10 – 25%) or significant (more than 25%) increases in cybersecurity spending. Companies with fair or poor outlooks take a more cautious approach, favoring smaller increases or no increase at all.
It raises an important question: Do stronger outlooks free up dollars for better controls or do better controls reduce losses and uncertainty, helping confidence recover? The data suggests the relationship runs both ways, creating a reinforcing cycle between spending and confidence.
Deep cut: An overwhelming 70% of companies with an excellent or very good outlook plan a moderate-to-significant increase in cybersecurity spending over the next 12 months, compared with just 32% of those with a fair or poor outlook. The gap highlights how closely confidence and risk posture are linked.
Significant increase (over 25%)
Moderate increase (10 – 25%)
Small increase (less than 10%)
No investment increase planned
3. Tool adoption outpaces training
Planned cybersecurity investments continue to focus on core protections. Multi‑factor authentication, anti‑virus / anti‑malware tools, computer security measures, and managed detection and response services are all seeing the highest levels of implementation over the next 12 months.
What lags behind is formal guidance and training. Roughly one in four companies plan to implement written security policies or social engineering training in the next year. That can leave companies exposed as fraudsters often target human behavior, blind spots, and weak processes.
The companies making the most progress pair new tools with clear internal expectations. They verify payment changes through a known contact, set clear rules for who can approve them, and train teams to spot impersonation before money moves.
Deep cut: Only 21% plan to roll out social engineering training, suggesting verification discipline and training remain among the most overlooked defenses.
Multi-factor authentication
Anti-virus / anti-malware protection on all business computers
Dual authorization for outgoing payments
Written information on security policies and procedures
Social engineering training
Fraud risk held steady at the headline level, but the work isn’t finished. BEC often emerges in the routine handoffs where trust, urgency, and speed intersect.
The firms best positioned are strengthening their processes, verifying before acting, and keeping people, not just systems, part of the control environment.
For complete survey findings, charts, and executive insights, download the full Middle Market Sentiment Report.
To see how we can help you reach your goals, contact us or visit key.com/commercial.
“KeyBank Middle Market Sentiment Survey,” April 28 – May 27, 2026. KeyBank’s Middle Market Sentiment surveyed more than 700 owners and executives of businesses with $10 million to $1 billion in annual revenue.
This is for general information purposes only and does not consider the specific investment objectives, financial situation, and particular needs of any individual person or entity. Information included was prepared based on survey respondents’ answers, information from business leaders considered to be reliable, and an express disclaimer of warranty, express or implied, as to such information’s accuracy or completeness. KeyBank does not provide legal advice.