The CyberFOX 2027 Security Maturity Index™ shows a gap between the security principles organizations endorse and the controls their teams can execute, and finds that operability is becoming a key security requirement.
TAMPA, Fla., November 3, 2026 – CyberFOX®, a global cybersecurity software provider helping IT teams control access, protect credentials, and secure connectivity, today released the CyberFOX 2027 Security Maturity Index™, a survey of 361 IT and cybersecurity leaders at small and mid-sized organizations. Sixty-two percent of leaders say limited staffing has left important security risks unaddressed, and 46% say their most significant known security gap has been open for at least six months.
Of the leaders surveyed, 60% say their organization closely follows least privilege principles, yet 54% say employees still retain standing administrator rights on their devices. Only 8% have completely replaced standing admin accounts with temporary elevation.
Key findings
- 75% say security responsibilities have grown faster than IT headcount over the past three years.
- 57% have implemented a security solution the team lacked the time or expertise to fully deploy or manage.
- 77% allow employees to use generative AI tools for work, while only 16% have comprehensive AI policies in place.
- 59% prioritize reducing administrative work over additional advanced features.
Smaller IT teams report wider gaps
Leaders on IT teams of fewer than 15 people report wider gaps than leaders on teams of 15 to 50, and they lean harder on managed service providers (MSPs) and managed security service providers (MSSPs).
|
Finding |
IT teams under 15 (n=206) |
IT teams of 15 to 50 (n=155) |
|
Limited staffing has left important security risks unaddressed |
81% |
37% |
|
Most significant known security gap has been open 12 months or longer |
34% |
10% |
|
Use an MSP or MSSP for at least one IT or cybersecurity function |
79% |
41% |
“Most IT leaders I talk to know exactly what they should be doing. They’ve read the frameworks and they agree with them,” said David Bellini, CEO of CyberFOX. “What they don’t have is enough people to keep every control running, so a known risk sits open for six months or a year. CyberFOX ran this research to measure the distance between what teams intend to do and what they can sustain.”
Operability is becoming a buying requirement
“A 10-person IT team gets the same audit questions and the same insurance questionnaire as a team five times its size,” said Andrew Bensinger, CTO of CyberFOX. “When the security work keeps growing and the team doesn’t, the controls that last are the ones that keep running without someone babysitting them.”
The report also introduces the Five Levels of Operable Security (Reactive, Developing, Operational, Managed, and Optimized), a model organizations can use to benchmark how consistently they run access controls.
About the research
CyberFOX commissioned independent research agency TrendCandy to survey 361 IT and cybersecurity leaders at the manager level and above, across 16 industry segments, at organizations with fewer than 5,000 employees and IT teams of 1 to 50 employees. The double-blind online survey has a margin of error of +/-5% at the 95% confidence level.
Availability
The CyberFOX 2027 Security Maturity Index is available for download at https://bit.ly/47TU7go. CyberFOX executives will discuss the findings with IT and security leaders in a webinar on November 19 at 12 p.m. EST. Register here.
About CyberFOX
CyberFOX® is the leading global cybersecurity software provider that delivers practical, proactive security for IT teams at small and mid-sized organizations. Its product portfolio closes the security gaps these teams face every day: CyberFOX AutoElevate for privileged access management, CyberFOX Password Manager to eliminate weak or reused passwords, CyberFOX DNS Filtering, an AI-powered web protection solution, Timus SASE, A CyberFOX Platform to replace outdated VPNs with Zero Trust Network Access, and Optimize365 for continuous Microsoft 365 tenant monitoring and hardening. Each product deploys in hours, runs with minimal upkeep, and is priced for real-world budgets, giving under-resourced IT teams enterprise-level security without enterprise complexity.
Learn more at www.cyberfox.com.
