TL;DR: Midmarket security teams are facing estate growth, tool sprawl, and exposure visibility gaps faster than their operating models can absorb, according to Intruder’s The Security Middle Child report. The data suggests confidence is outpacing practical control coverage, which makes governance, prioritisation, and board reporting the real pressure points.
At a glance
What this is: Intruder’s survey shows midmarket security teams are struggling to keep pace with fast-growing estates, fragmented tooling and limited visibility as confidence remains high.
Why it matters: This matters because identity, access and exposure decisions increasingly depend on whether teams can see what is exposed, prioritise what matters and report risk credibly beyond the security function.
By the numbers:
- 91% of midmarket organisations saw their digital estate grow over the past 24 months.
- 42% of teams describe themselves as stretched, overwhelmed, or consistently behind.
- 44% of teams have either outgrown their stack or stitched it together from point solutions.
Context
Midmarket security teams are under pressure because their estates are expanding faster than their operating models. The article describes organisations that are large enough to face meaningful exposure, but not large enough to absorb enterprise-grade process sprawl without gaps in visibility, prioritisation and reporting.
The underlying governance issue is not simply tool count. When security coverage, headcount and board engagement do not scale alongside the digital estate, teams end up making decisions with partial context. Where identity and access are part of that estate, blind spots in service accounts, cloud permissions and SaaS connections can quickly become exposure problems.
Key questions
Q: What breaks when midmarket security teams rely on fragmented tool stacks?
A: Fragmented stacks break shared visibility. Different tools may each provide useful signals, but they rarely produce a single, timely view of exposure, ownership, and prioritisation. The result is slower remediation, inconsistent risk judgments, and confidence at leadership level that is not matched by operational certainty among the teams doing the work.
Q: Why does tool sprawl create security risk in managed services?
A: Tool sprawl creates security risk because every extra console introduces another chance for policy mismatch, configuration drift, and technician error. When identity, device, and application controls are split across systems, teams lose confidence that enforcement is consistent across all clients. The risk is not only inefficiency, but uneven governance.
Q: How should security teams measure whether exposure management is actually reducing risk?
A: Measure whether validated attack paths, privileged access paths, and high-risk exposures are being removed, then confirm those fixes with retesting. Counts of alerts or scans only show activity. A useful metric changes when the control state changes, especially for identity-related risk.
Q: What should leaders report to the board when the estate is growing faster than coverage?
A: Report how much of the estate is actually visible, how long critical exposures remain untriaged, and where remediation is delayed by fragmented tooling. Boards need operational measures of exposure control, not just counts of threats or budget growth.
Technical breakdown
Digital estate growth and control coverage gaps
A digital estate is the full set of assets, services, users, cloud resources and exposed systems a team must govern. In midmarket environments, growth often happens in several layers at once: more SaaS, more cloud, more endpoints and more third-party connections. Controls that were adequate at smaller scale start to fragment because inventory, ownership and exposure review no longer keep pace with change. The result is not just more work, but a higher chance that assets remain untracked or misprioritised when risk decisions are made.
Practical implication: tie asset discovery and ownership review to the rate of estate change, not to a fixed calendar.
Tool sprawl, visibility and exposure management
Tool sprawl appears when security teams add point solutions faster than they can integrate them into a coherent operating model. That creates overlapping alerts, inconsistent telemetry and gaps between what each tool can see. Visibility problems then move from a reporting nuisance to a control issue, because teams cannot reliably determine which systems are internet-facing, which identities are overexposed, or which weaknesses sit outside a single dashboard. In practical terms, the stack becomes a set of partial views rather than a governed exposure model.
Practical implication: consolidate around a single exposure inventory before adding another layer of detection or automation.
Why confidence can outpace security posture
Confidence often rises with budget and leadership attention, but posture only improves when teams can actually measure exposure reduction. Midmarket leaders may feel they can identify critical threats, yet the article shows many still need around a week to assess a critical zero-day while attackers can move within 24 to 48 hours. That gap is especially relevant to identity-driven attack paths, where exposed SaaS accounts, cloud permissions and machine credentials can be abused before review cycles catch up. The core issue is not optimism alone, but a mismatch between perceived readiness and operational latency.
Practical implication: measure exposure assessment time against attacker timelines, not against annual planning cycles.
Threat narrative
Attacker objective: The attacker objective is to find and exploit the parts of the midmarket estate that the organisation cannot see, prioritise or remediate quickly enough.
- Entry occurs through the expanding attack surface, where internet-facing assets, cloud environments and SaaS connections outpace complete visibility.
- Escalation follows when fragmented tooling and limited prioritisation leave exposed systems, identities or permissions unreviewed long enough to be abused.
- Impact is the inability to identify and remediate critical threats before attackers exploit them, especially where exposure changes faster than the team can assess it.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Midmarket cyber sprawl is now a governance problem, not just a tooling problem. The article shows that many teams have added controls, yet still cannot create a unified view of exposure across cloud, SaaS and internet-facing assets. That is a governance failure because control coverage is no longer aligned to estate growth. The practitioner implication is to treat visibility as an operating model issue, not a dashboard issue.
Exposure visibility gap: when asset growth outpaces inventory, prioritisation breaks first. Midmarket teams often still believe they can identify critical risk quickly, but the data suggests the opposite: exposure assessment slows as the estate expands. Once teams cannot reliably see what is exposed, they cannot distinguish urgent remediation from background noise. Practitioners should re-centre risk management on asset completeness and exposure ownership.
Identity and access blind spots are part of the same sprawl pattern. The article is not an identity report, but the governance lesson applies directly to NHI, SaaS and cloud access. Where service accounts, API keys and delegated app access sit inside fragmented estates, untracked entitlements become another form of invisible exposure. The implication for IAM and PAM teams is that identity inventory must be tied to the broader exposure model, not managed as a separate programme.
Board reporting is failing to keep pace with operational reality. Only a small share of midmarket organisations take cyber risk to the board, which means leadership may be hearing confidence signals without the operational detail behind them. That creates a false sense of control when tool sprawl and exposure lag are still unresolved. The practitioner conclusion is to report exposure latency, not just threat counts, so governance reflects actual response capacity.
What this signals
Midmarket cyber sprawl will keep widening until visibility becomes the primary control objective. Buying more tools will not close the gap if teams cannot build a single view of internet-facing assets, cloud connections and identity surfaces. Practitioners should expect exposure latency to become a standing governance metric alongside coverage and remediation.
The identity layer sits inside the same visibility problem. As estates expand, service accounts, API keys and delegated SaaS access become part of the hidden attack surface unless they are governed in the same inventory as infrastructure. Teams that separate identity governance from exposure management will keep missing the same classes of risk.
Exposure management needs executive language, not just technical metrics. If leadership only hears that confidence is high, they will miss the fact that prioritisation and response lag are still constrained by fragmented tooling. The right signal is whether the organisation can see and act on a critical exposure before attacker timelines close the window.
For practitioners
- Build a single exposure inventory Create one authoritative inventory for internet-facing assets, cloud environments, SaaS connections and owned identities so prioritisation starts from complete coverage, not partial tool views.
- Measure exposure assessment latency Track how long it takes your team to assess a critical zero-day or material exposure from disclosure to decision, then compare that with attacker exploitation timelines.
- Map identity assets into the same governance model Include service accounts, API keys, delegated application access and privileged cloud roles in the same exposure review process as hosts and applications.
- Reduce tool overlap before adding more automation Identify where multiple products produce the same alert or visibility stream, then remove overlap that does not improve ownership, response speed or reporting quality.
- Elevate exposure reporting to executive level Report on visibility gaps, remediation lag and unresolved internet-facing exposure in business terms so cyber risk discussions include the board or executive tier that owns prioritisation.
Key takeaways
- Midmarket security teams are growing beyond the operating assumptions built into their current stacks, which turns visibility and prioritisation into the main control gaps.
- The article shows a mismatch between confidence and practical coverage, with many teams still struggling to see what is exposed fast enough to act.
- The most effective response is to align asset inventory, identity governance and executive reporting to the actual pace of estate change.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organisation are inventoried | Inventory and visibility are central because the article is about estates outgrowing control coverage. |
| DE.CM-08 — Vulnerabilities in external-facing assets are monitored and detected | The article stresses internet-facing exposure and delayed assessment of critical zero-days. | |
| Recommendation — Inventory assets and identities continuously so exposure management starts from a complete asset picture. Monitor external-facing assets for exposure and shorten the time from discovery to triage. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | CIS asset inventory directly addresses the visibility gap created by rapid estate growth. |
| Recommendation — Maintain an authoritative asset inventory that includes cloud, SaaS and internet-facing systems. | ||
| MITRE ATT&CK | TA0007 — Discovery | Attackers benefit when fragmented visibility leaves exposed assets undiscovered. |
| Recommendation — Map discovery gaps to ATT&CK discovery exposure and prioritise the assets most likely to be found first. | ||
Key terms
- Digital Estate Growth: The expansion of cloud services, applications, endpoints, and integrations that an organisation must secure. It matters because growth increases the number of assets, ownership questions, and control paths that security teams must keep current.
- Exposure management: Exposure management is the practice of identifying which assets are reachable by attackers and reducing that reach before exploitation occurs. For collaboration systems like SharePoint, it is not enough to know that a patch exists, because public accessibility changes the speed and likelihood of attack.
- Tool Sprawl: Tool sprawl is the accumulation of overlapping systems that each solve part of the same identity or operations problem. In practice, it creates duplicate workflows, inconsistent policy enforcement, and more manual reconciliation, which weakens confidence in access decisions and slows down secure scaling.
- Security posture: Security posture is the current state of an organisation’s defensive controls, governance, and operating discipline. In identity programmes, posture includes MFA, logging, access reviews, privileged access management, rotation, and offboarding. Insurers and auditors use it as a practical proxy for how likely the organisation is to suffer and contain loss.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suited to practitioners who need to connect identity control with broader security operations and governance.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org