Cybersecurity: the middle market’s top capital priority
A Capital One survey shows cybersecurity has overtaken sales and marketing as the middle market’s top priority for capital.
Middle market leaders report that their companies are thriving and say they are confident about the future. But their biggest capital bet isn’t a traditional growth engine. Cybersecurity and risk management top the list of capital deployment priorities as leaders invest in AI, cloud computing and enhanced data analysis.
Defending areas of expansion is now inseparable from pursuing them.
Capital One’s 2025 Middle Market Strategic Investments Study of 1,011 U.S. financial decision-makers found that cybersecurity and risk management (49%) now tops the list of capital deployment priorities, just ahead of sales and marketing (48%).
For years, cybersecurity lived in the IT budget; it was a cost center measured by what it prevented rather than what it produced. Our survey suggests that era is ending. Cybersecurity and risk management not only edged out sales and marketing as a capital priority, but surpassed cash flow optimization (44%) and research and development (42%).
This isn’t a defensive posture. The same survey shows leaders are overwhelmingly optimistic, with 89% saying they are confident their business will grow over the next 12 months, and 73% citing more opportunity than challenge in the current environment. Spending on cybersecurity, in other words, is a sign of confidence, not caution.
Cybersecurity has moved out of the server room and into the boardroom. Protecting the business has become more than an IT line item. It’s a strategic decision about how the company grows, what risks it can absorb, and how much trust it can earn from customers, partners and lenders.
“AI is changing the cybersecurity landscape, and it’s no surprise that we’re seeing companies move into a much more proactive approach when it comes to strengthening their defense posture.” Michael Eastep, CTO, Capital One Commercial Bank and Small Business Bank.
Protecting growth demands strong defenses.
Our survey shows that investments in growth and risk mitigation rise together rather than compete.
Two-thirds of leaders (66%) name AI as a top investment area for the next 12 months—more than any other category—followed by IT and cloud infrastructure (53%) and data and analytics (47%). Twenty-nine percent of leaders say AI will produce the biggest return on investment over the coming year, well ahead of any other category.
Every one of those investments widens the field of potential vulnerabilities that a business must defend. Greater use of AI, the cloud and advanced analytics, means many companies will face more data pipelines, access points and sensitive information concentrated in more places. Under these conditions, cybersecurity is increasingly part of the growth plan. Under these conditions, cybersecurity is part of the growth plan. A company can’t scale a digital business faster than it can protect it, and the leaders in this survey appear to understand that.
Expansion and exposure are two sides of the same buildout, and middle market leaders are funding them together.
When the foundation becomes the priority
Cybersecurity used to be described in the language of insurance—the cost for avoiding a worse outcome. Increasingly, it’s described in the language of infrastructure—a foundation everything else is built on.
The things middle market companies are building now, from AI-driven products to data-rich customer relationships, only work if the underlying systems are trusted. Customers share data because they trust it will be protected. Partners integrate systems because they believe the connection is secure. Lenders extend capital because they are confident the business can manage its risk. Cybersecurity has quietly become the foundation that makes digital growth possible, which is why it’s competing with sales and marketing for the top of the capital budget.
But capital alone can’t finish the job. Forty-three percent of businesses report a technical skills gap in cybersecurity, second only to the AI skills gap (58%). A company can fund the tools, but it still needs people who know how to use them.
The same leaders investing in defense are investing in their people: 68% are funding formal training and professional development, and 57% are leaning on technology-based learning tools. They are treating efforts to close the skills gap as part of the security strategy.
Cybersecurity is core not just to a company’s technology strategy, but to their business strategy. A breach impacts their ability to do business and erodes their customer’s trust. Across industries, we’re seeing more and more investment in upskilling staff and bringing in additional support to deepen their cyber expertise.
Navigating the shift from the inside
Capital One isn’t watching this shift from the sidelines. We’re navigating it alongside our clients. As a company built on technology, we're investing in AI, cloud and data while actively protecting the systems and customer trust that growth depends on, similarly to middle market leaders. We’ve even released open-source solutions like our VulnHunter automated vulnerability scanner.
That shared experience is central to how we serve middle market companies. A banking partner working through these similar operational challenges brings a perspective that goes beyond capital. In a year when protecting growth strategies is part of that strategy, the most valuable partner is one who understands what middle market leaders are facing.
See where middle market companies are investing their resources—read the full study.
Source: Capital One analysis of respondent data from the 2025 Middle Market Strategic Investments Survey Key Findings.