Midsize company cybersecurity budgets face unprecedented pressure in 2025. Cyberattacks on small and midsize businesses have surged 16%, while the average breach costs have increased 13% from 2024—representing a significant financial impact that can threaten business viability. Meanwhile, 83% of SMBs report that AI-powered attacks have raised the threat level, and ransomware incidents have exploded by 126% year-over-year.
Yet despite 94% of business leaders acknowledging cyber threats as a serious risk, only 42% provide regular security training to employees. This awareness-execution gap is precisely what makes midsize organizations the forgotten stepchild of cybersecurity: too big to fly under attackers’ radar, too small for enterprise budgets.
In this exclusive Security Weekly interview from InfoSec World 2025, Ridge IT Cyber’s Chief Strategy Officer Perry Schumacher reveals proven strategies for maximizing security budgets, automating threat response, and securing executive buy-in—strategies that helped his team deploy secure remote access for hundreds of companies in 48-72 hours during the COVID-19 crisis.
Midsize companies occupy a uniquely vulnerable position. With 50-500 employees, they possess valuable data and intellectual property that attracts sophisticated threat actors. But unlike Fortune 500 enterprises, they lack dedicated security teams, specialized expertise, and the budgets to implement comprehensive defenses.
2025 threat landscape data confirms this reality:
The solution isn’t simply “doing more with less”—it’s about working smarter through strategic tool selection, automation, and partnership models that extend your team’s capabilities.
Midsize companies are the 'forgotten stepchild' of cybersecurity. They face enterprise-level threats—ransomware, advanced persistent threats, supply chain attacks—but they're working with 3-person IT teams and budgets that force difficult trade-offs.
Before diving into tool selection or budget allocation, Perry emphasizes starting with clarity on why you’re investing in cybersecurity at all.
“Everybody has a tool, zero trust, comply-to-connect—there’s acronyms galore,” Perry notes. “But if we’re in cybersecurity, we’re after two key objectives:”
Why this framework matters for budget planning: Every security tool purchase, every staffing decision, every policy implementation should support one or both of these objectives. If a solution doesn’t clearly advance business continuity or data protection, question whether it’s worth the investment.
If we can funnel every solution that we look at underneath those two primary objectives, things make a lot more sense. It's about keeping things simple because they do get complex as to how you go about doing it.
When evaluating cybersecurity budget allocation, most midsize companies focus too heavily on upfront costs and miss the bigger picture: operational expenses over 3-5 years typically dwarf implementation fees.
“I call it ‘build the house right,'” Perry explains. “What does it cost to do an implementation? That’s all one-time fees. But after that, it’s the operational cost that really matters—that’s what hits the bottom line over the next three, four, five years.”
Consider two email security solutions:
While Option A costs more upfront, when calculated over a 5-year period, it may actually deliver lower total cost of ownership—and that’s before factoring in reduced staffing needs if it offers better automation.
When allocating your midsize company cybersecurity budget, ask:
2025 benchmark data: Preventive cybersecurity measures offer a significant return on investment compared to the cost of recovering from an average breach—industry studies show ROI ratios exceeding 10:1 for proactive security investments.
When managing security for midsize companies with 3-10 person IT teams who handle both operations AND security, automation isn’t optional—it’s essential.
The automation imperative: 70% of SMBs report relying on outside experts for security guidance precisely because their internal teams lack the bandwidth to stay current on every threat, tool, and best practice.
This automation delivers multiple benefits:
2025 reality check: With phishing attacks up 57.5% and ransomware tied to 75% of breaches, speed of response directly impacts breach costs. Automated tool integration is no longer a luxury—it’s table stakes.
Many midsize companies consider managed security service providers (MSSPs) to augment limited internal teams. But Perry warns against partnerships that require surrendering administrative control—a common MSSP business model.
What NOT to do: “A lot of people when they engage you, they want to be like, ‘Well, I own the environment. I’m going to take away your admin rights and I have the admin rights.’ And to me, that never made sense. As an entrepreneur myself, if you try to tell me you’re going to take control away from me and I’m going to pay you for the privilege, it’s just not going to go well.”
The better approach: Your 3-person IT team maintains administrative rights and control. Security partners function as an extension of your team, not a replacement.
This ensures:
Your internal IT team handles:
Specialized MSSP partners provide:
2025 market dynamics: With 70% of SMBs relying on outside experts and only 42% providing regular employee training, the MSSP market continues to experience rapid growth globally—but success requires partnership models that respect client autonomy.
The most sophisticated cybersecurity budget strategy fails without executive buy-in. Perry shares his framework for translating technical security needs into business language that C-suite leaders understand.
Key message for leadership: “You have me here as a cybersecurity professional for two reasons. First, to ensure this business continues running without disruption from cyber incidents. Second, to ensure all key company data remains secure and confidential.”
This framing works because it maps security investments directly to business outcomes executives care about: revenue continuity and risk mitigation.
When requesting cybersecurity budget approval, structure requests around these business impacts:
Business Continuity Impact:
Data Protection Impact:
Risk Quantification:
Competitive Context:
“When communicating to executives,” Perry emphasizes, “we’ve got to understand the purpose. Business continuity—the reason that you have me here is to make sure that this business continues to run. And the second reason is to make sure that all the key data of this company remains secure. Using that as your tool internally to justify why you need things—I think an executive has a little further understanding of that.”
When COVID-19 forced the rapid shift to remote work in March 2020, midsize companies discovered that free VPN solutions couldn’t scale across their entire workforce. Perry shares Ridge IT Cyber’s response to hundreds of panicked Friday afternoon calls.
Friday, March 2020: “We can’t go to the office Monday, our employees need remote access, and our free VPN isn’t working. Can you help?”
The additional complexity: Hardware lead times from China measured in months (if available at all), making traditional VPN appliances impossible to deploy quickly.
Ridge IT deployed SASE (Secure Access Service Edge) solutions that enabled:
The results: “We helped hundreds of organizations transition to secure remote work within days. We were able to turn people around where they’re calling on Friday going, ‘I don’t know how we’re going to continue running the business. Do you guys have anything?’ And go, ‘Sure, here it is. It’s affordable. If you sign this today, by Monday, you’re running again.'”
The COVID response demonstrates that midsize company cybersecurity doesn’t require massive budgets—it requires:
2025 application: As AI-powered attacks increase 126% and phishing surges 57.5%, the need for rapid deployment of modern security tools has never been higher. The same SASE and zero trust technologies that enabled remote work now provide the foundation for defending against today’s threats.
Before “zero trust” became a marketing buzzword saturating every vendor pitch deck, Ridge IT Cyber was building zero trust architectures for midsize clients. That pre-COVID preparation proved invaluable when the pandemic hit.
Traditional security operated on a “castle and moat” model: hard perimeter, soft interior. Once someone breached the firewall, they had broad access to internal resources.
Zero trust flips this: Never trust, always verify—even inside your network perimeter. Every access request requires authentication and authorization regardless of location.
With 15% of employees using AI tools without security oversight and cloud adoption continuing to accelerate, the traditional network perimeter has dissolved. Zero trust provides the framework for securing distributed workforces, cloud applications, and BYOD environments—exactly what midsize companies need.
We developed a zero trust architecture pre-COVID, During COVID we got to test how good it actually was, because during COVID everybody got budget, everybody wanted to move to least privilege access, zero trust, comply-to-connect—much of the same concepts under different banners. And we've seen our solution work over and over again. We're deploying it to the government.
Filter every security decision through two lenses:
Stop evaluating tools based solely on implementation costs. Calculate:
Benchmark: Preventive security measures deliver significant ROI compared to average breach recovery costs—industry studies consistently show ratios exceeding 10:1.
Prioritize security tools with strong integration capabilities:
Result: Your 3-10 person IT team shifts from reactive firefighting to proactive supervision.
Find MSSPs who:
Benchmark: 70% of SMBs rely on outside experts—don’t try to do everything in-house.
When requesting budget approval, connect investments to:
Executive pitch: “I’m here to ensure this business continues running without disruption, and to ensure all company data remains secure.”
Perry Schumacher is the Chief Strategy Officer at Ridge IT Cyber, bringing an unconventional background that spans aeronautics, international work in the Amazon and Africa, and philosophy. His unique trajectory has shaped his approach to cybersecurity: remain a perpetual student, avoid sacred cows, and adapt strategies based on context rather than rigid frameworks.
Perry specializes in creating Zero Trust architectures for midsize organizations, helping security teams with limited resources achieve enterprise-grade protection. His philosophy centers on simplification—cutting through industry buzzwords to focus on the fundamentals: keeping businesses running and protecting critical data.
Security Weekly provides cybersecurity professionals with actionable insights through podcasts, interviews, and technical content. They cut through the noise to deliver practical strategies you can implement immediately.
Rapid response times, with around the clock IT support, from Inc. Magazine’s #1 MSSP.