Black Kite Research Reveals That Ransomware's Primary Target Is the Mid-Market, Not Enterprises as Widely Assumed

Black Kite's first mid-market study finds that from 2023 through H1 2026, 73% of ransomware attacks in North America and Europe hit companies with $10M to $1B in annual revenue

BOSTON, Aug. 18, 2026 /PRNewswire/ -- Black Kite, the leader in third-party cyber risk management, today released its newest report, Mid-Market Is the Routine Target: Ransomware, Third-Party Risk, and the Widening AI Gap. Assessing 120,128 mid-market organizations across North America and Europe from an attacker's perspective, the report examines why these companies bear the brunt of ransomware attacks, and draws on disclosed incident data and external attack-surface scans to understand the pattern and what mid-market companies can do to protect themselves.

"This is the first time we examined the mid-market as a segment in its own right, rather than a set of companies scattered through larger studies," said Ferhat Dikbiyik, Chief Research & Intelligence Officer (CRIO), Black Kite. "The report is only the beginning. We're continuously expanding Black Kite with capabilities designed specifically for mid-market organizations, helping smaller security teams identify, prioritize, and reduce cyber risk without requiring enterprise-sized teams or budgets."

Black Kite's analysis of 13,336 ransomware incidents with verifiable revenue across North America and Europe from January 2023 to June 2026 found that 73% of those incidents struck mid-market organizations with annual revenues between $10M and $1B. This concentration has proven highly consistent over time: 74.6% in 2023, 72.1% in 2024, 74% in 2025, and 72.3% during the first half of 2026. Even as the absolute number of incidents grew by 44%, surging from 2,320 in 2023 to 3,340 in 2025, the proportion of mid-market targets held firm.

Additional findings from the report:

• Nearly three in four (73%) ransomware victims were mid-market companies between 2023 and the first half of 2026. More than half of those victims generated less than $50M in annual revenue.
• The mid-market's share of incidents has remained remarkably steady over the four year period, accounting for approximately 72-75% of victims each year, even as the absolute number of ransomware victims increased.
• Manufacturing was the most targeted industry, representing more than 25% of mid-market ransomware victims, followed by professional, scientific and technical services, and construction.
• More than one in four mid-market organizations (28.3%) carried at least one known exploited vulnerability (KEV)
• More than half (54.7%) had at least one significant patch management finding on public-facing software.
• Nearly half (48.1%) carried at least one disclosed vulnerability with a CVSS score of 8.0 or higher.
• Nearly one in three (32.3%) had at least one stealer log finding.
• Nearly half (46.8%) had missing or insufficient DMARC protection.

Why the Mid-Market Is Under Pressure
Mid-market organizations face a growing challenge. They are increasingly targeted by ransomware while also exposed to cyber risk across hundreds of third-party vendors. Both require continuous visibility and rapid response, stretching even well-resourced security teams. Mid-market companies also sit inside the vendor profile of the larger organizations they serve. Regulation on both sides of the Atlantic, from the EU's NIS2 Directive to U.S. rules like NYCRR 500 and HIPAA, increasingly makes a customer responsible for its suppliers' security, which puts mid-market vendors under direct pressure to prove their posture.

AI Is Widening the Gap
Artificial intelligence is accelerating the discovery of software vulnerabilities, and the same tools that help organizations find flaws in their own systems are also available to attackers. For mid-market companies with smaller security teams and tighter budgets, keeping pace is far more difficult. Published research shows many mid-sized organizations lag in adopting AI for security. ISC2's 2025 Cybersecurity Workforce Study found that only 20% of mid-sized organizations have adopted AI tools into their security operations.

The report findings point to a clear conclusion: mid-market exposure is measurable, the obligation to address it is real, and the constraint is capacity. Organizations need security capabilities that help them identify, prioritize, and reduce cyber risk without requiring enterprise-sized teams or budgets.

To help mid-market organizations understand their own exposure, Black Kite is offering a complimentary Ransomware Susceptibility Index^® (RSI™) Briefing. Based on Black Kite's industry-leading ransomware intelligence, the briefing provides:

• Your organization's Ransomware Susceptibility Index^® (RSI™)
• Key findings driving your ransomware risk
• How your organization compares to industry peers
• Prioritized recommendations to reduce cyber risk

Request your complimentary RSI™ Briefing at: https://blackkite.com/free-rsi-rating

Organizations ready to go further can gain ongoing access to Black Kite's intelligence, including RSI™, FocusTags^®, and Digital Breach Intelligence (DBI), and integrate AI into their security program with Black Kite's AI Agent. Organizations can manage the Black Kite platform either directly or through a trusted Managed Security Service Provider (MSSP).

To read the report, visit https://blackkite.com/reports/2026-mid-market-report/

Methodology
This data presented in the report was assembled by the Black Kite Research Group™ from two independent datasets: ransomware incident tracking across North America and Europe, and a snapshot of externally observable risk findings across the monitored mid-market population. The first establishes which companies were attacked. The second describes how companies of this size appear from the internet. The ransomware data spans January 2023 to June 2026 and is analyzed across seven half-year periods. The mid-market is defined by annual revenue, following the Dun & Bradstreet revenue-based definition, with no employee-count criterion applied. Three bands are reported: lower mid-market at $10M to $50M, core mid-market at $50M to $500M, and upper mid-market at $500M to $1B.

About Black Kite
Black Kite is an AI-native third-party cyber risk management platform built for the connected world. By distilling billions of external risk signals from millions of monitored organizations, Black Kite delivers the trusted intelligence that powers a connected defense network, enabling organizations to identify risk earlier, act faster, and move from isolated defense to collective resilience. With Black Kite, organizations benefit from greater control, earlier warning, and the confidence to work safely with third parties at scale. Black Kite has received numerous industry awards and recognition from customers. Learn more at www.blackkite.com, or on the Black Kite blog.

Media Contact:
Michelle Kearney
Hi-Touch PR
443-857-9468
[email protected]

SOURCE Black Kite