I've been told no on a patch window more times than I can count. The answers are always reasonable, and they're always some version of the same thing.
"We can't afford the downtime. Skip it this time."
"I know you said 48 hours. Do what you can between midnight and six."
"We've got a big thing coming up. Not this quarter."
None of that comes from villains. It comes from people making a defensible trade with bad information. And after six or ten months of it, the person who kept asking stops asking. They polish the resume. Some park at the desk and play solitaire. Some burn out completely.
That's the part nobody puts in the incident report.
The information is worse than they think
Black Kite published research last week finding that 73% of disclosed ransomware and extortion incidents with known revenue hit companies between $10 million and $1 billion. The share has held between 72% and 75% every year since 2023, even as total incidents grew 44%.
Someone is going to point out that there are far more mid-market companies than enterprises, so of course they're most of the victims. That's a fair objection, and it's why I'm not going to lean on the headline number.
Lean on the condition instead. Black Kite assessed 120,128 mid-market organizations. More than half, 54.7%, had at least one significant patch-management problem on a public-facing system. Over a quarter carried a vulnerability already known to be exploited. Nearly a third had credentials sitting in stealer logs, meaning someone already has a working key. Those aren't counts of who got hit. They're measurements of what state these companies are in right now, and they hold regardless of how many companies you're dividing by.
Then there's the timing. Mandiant's M-Trends 2026 reports that mean time-to-exploit has inverted to roughly negative seven days. Exploitation routinely beats patch availability to market. In 2018 defenders worked with a 63-day cushion. So when the business says "skip it this time, we'll catch it next quarter," the window they think they're borrowing against closed before the vendor shipped the fix.
The first casualty is a person
Average CISO tenure runs 18 to 26 months. The C-suite average is 4.9 years. Proofpoint's Voice of the CISO found 63% of security leaders experienced or witnessed burnout in the past year. Sophos puts it at 76%.
We are not blameless in this. The CISO tends to be the least business-focused person with a C in the title. We're the department of No. Legal only likes us because we say no faster than they do. A lot of good people have spent the last decade working to fix that from inside the profession, and the work is real.
But the other half of the problem is that the business sees security as an impediment rather than a partner whose entire job is reducing risk so the company can make money more safely. It's hard to stay good at this work when you're treated like the grim reaper. Here's security again, showing up to explain why we can't make money today.
Your breach doesn't start with an attacker. It starts the day the person who kept asking gave up.
Small budget means a different shape, not a smaller version of the same thing
The mid-market gets this worse, and the reason isn't the size of the budget. It's the shape of the program.
When your budget is smaller, you need to spend more per person, not less. That doesn't mean a bigger team. It means that if you have any hope of winning you have to be the 300 Spartans, not the 300,000 Persians. Navy SEALs, not a battalion. You can't field an army, so you hire extreme experts, pay them well, and listen when they speak.
The pattern I keep seeing is the exact opposite. Underpay for a CISO who wants the title more than the job. Staff under them at roughly half the going rate. Undercut them at every turn while talking about the large investment you've made in cyber. Back the whole thing with a substandard MSSP, or worse, the consulting firm that runs your ERP and has a small underfunded cyber practice that naps for days at a time.
That isn't a dutiful attempt to protect your enterprise and your customer data. That's a joke in a mall cop uniform. Paul Blart is funny on the big screen, or as a late-night guilty pleasure on streaming. He is not funny as your security program.
What outsourcing is actually for
Outsourcing isn't the problem. I outsource to hire someone whose core business is the thing I'm outsourcing. I hire a shipper because I make products and don't want the complexity of running a logistics company. Same logic applies to security. You need a partner whose core focus is cybersecurity. If it's an add-on or an also-ran, you're buying more of the same thing under a different financial model.
A real partner has a solid platform, AI agents that help absorb volume, and a bench of experts far deeper than you could justify hiring. They don't replace your team. Their job is to understand the cybersecurity industry. Your team's job is to understand your company.
Market knowledge does not equal tribal knowledge. You need both.
If your security program arrived as an add-to-cart option, you bought Temu Cybersecurity. And that one is on you.
The number, and what I'm doing with it
IANS and Artico benchmark mid-market security budgets at an average of 1.1% of revenue, roughly $11,000 per million, with budgets in the segment running $600,000 to $5 million.
I want to be honest about what I'm doing with that figure. IANS reports it as a description of what mid-market companies actually spend. I'm treating it as a floor. That's my move, not theirs, and here's why I think it's fair: the same population producing that average is the population showing 54.7% patch failure rates and a third of organizations with leaked credentials in circulation. An average drawn from a group that's visibly losing is a starting line, not a finish line.
TO MID-MARKET CEOs: Make sure your budget is real. Roughly 1.1% of revenue is maintenance. If you're a laggard, you have to catch up, and catching up costs substantially more than maintenance does. Treat it as a one-time cost. Stretching it across three years costs more, wastes more, and delays any actual risk reduction until the modernization finishes. You're also required to listen when your CISO makes a request. Hire an outside expert to validate and audit that person's capabilities if you want. That's reasonable. But once you have a trusted cyber expert, listen and act. In the near term a good vCISO can fill the gap. There are many excellent ones, and many who are poor excuses for cyber pros.
TO MID-MARKET CISOs: Stop treading water. If your budget tripled tomorrow, what would you do with it? If your CEO called today and asked for the ten most important things to reduce company risk, do you have the answer ready? If you were invited to present to the board next week, could you do it in their language? Do you have a mentor network making you better at this? If you answered no to any of those, you have homework. Cancel your weekend. Heavy is the head that wears the crown.
TO MSSPs: How are you advising your customers? Can you help them build a modern, cohesive, executable strategic plan? Or are you a response center? The first is worth real money. The second isn't.
We need to get better at this before it all comes down and we make the news again.
If your cybersecurity strategy is "we crossed all our fingers and YOLO'd some tooling and services," you are set up for a perfect failure regardless of which chair you sit in.