Mid-market ransomware and the patch-now problem: what this month's data and Citrix zero-days tell us

There's a comfortable story many mid-sized organisations tell themselves: ransomware crews chase the big names, and we're too small to be interesting. Two pieces of recent news make that story hard to sustain, one about who actually gets hit, and one about how quickly the front door can be forced open.

The mid-market is the main target, and has been for years

Black Kite's 2026 mid-market report analysed 13,336 ransomware incidents with verifiable revenue across North America and Europe between January 2023 and June 2026. It found that 73% hit organisations with annual revenue between $10 million and $1 billion. The share has barely moved: 74.6% in 2023, 72.1% in 2024, 74.0% in 2025 and 72.3% in the first half of 2026.

That stability is the real finding. Incident numbers climbed by 44% between 2023 and 2025, yet the proportion landing on mid-sized firms stayed put. This isn't a blip or a trend you can wait out. Manufacturing was the most targeted sector at more than 25% of mid-market victims, followed by professional services and construction.

The exposure is mundane

The report's exposure figures are unglamorous, which is exactly why they matter. Of the 120,128 companies Black Kite monitored, 28.3% carried at least one known exploited vulnerability on an internet-facing system. Another 48.1% had disclosed vulnerabilities rated CVSS 8.0 or higher, and 46.8% had missing or insufficient DMARC protection.

None of that requires a sophisticated adversary. It requires someone to scan, find an unpatched system and walk in.

A live example: Citrix NetScaler

If you want to see how that plays out in real time, look at what happened on 27 September. Citrix disclosed eight NetScaler ADC and Gateway vulnerabilities and confirmed two of them, CVE-2026-88771 and CVE-2026-88772, had been exploited as zero-days before a patch existed. Both are rated 9.5 on CVSS v4.0. According to reporting, the first allows an unauthenticated attacker to run commands on default configurations, and the second is reachable when DTLS is enabled, which is the default on VPN virtual servers.

CISA added both to its Known Exploited Vulnerabilities (KEV) catalogue the same day and directed US federal civilian agencies to patch or disconnect affected appliances by 30 September. You may not be a federal agency, but that deadline is a useful benchmark: when the people with the best threat intelligence give themselves three days, a quarterly patch cycle isn't a plan.

What this means in practice

Put the two stories together and the lesson is about prioritisation, not volume. You will never patch everything immediately. You can, however, decide what gets patched first.

• Treat "known exploited" as its own tier. A KEV listing means attackers are using the flaw now. Those items jump the queue ahead of higher-scored but theoretical issues. Black Kite's own first recommendation is to prioritise vulnerabilities exploited in the wild.
• Know your edge. VPNs, gateways, firewalls and remote access appliances are where these flaws keep landing. Keep an accurate inventory of what faces the internet, who owns it and what version it runs.
• Have an emergency path. Decide in advance who can authorise an out-of-hours patch or take an appliance offline, so the decision doesn't wait for a committee.
• Look past the technical layer. The same report recommends tightening help desk identity verification and defences against vishing and impersonation, since stolen access isn't always found by scanning.
• Extend risk management to suppliers. Questionnaires alone don't tell you whether a vendor's exposed systems are patched.
• Fix the cheap things. Missing DMARC is easy to remediate and removes an easy impersonation route.

Make it a governance question, not just an IT task

For boards and executives, the useful questions are simple. How many internet-facing systems do we have? How quickly did we patch the last actively exploited flaw? Who decides when to pull a system offline? If nobody can answer in a sentence, that's the gap.

This is where an independent view helps. A vCISO or security maturity assessment can establish your real exposure, set patching priorities that match actual attacker behaviour and give leadership reporting they can act on, without the vendor sales pitch.

Sources: Black Kite, 2026 Mid-Market Report; Cybersecurity Dive, Black Kite mid-market ransomware coverage; CISA, Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway; The Next Web, Hackers are exploiting two critical Citrix NetScaler zero-days.