AI is the best opportunity in years for smaller companies to compete above their weight class, but that advantage holds only if governance keeps pace with adoption.
AI has created a paradox that comes up in almost every conversation I have with midmarket IT leaders. Smaller companies arguably have more to gain from AI than any other group. A 400-person firm can’t hire its way to the scale of a Fortune 500 competitor, but it can use AI to extend the reach of every employee it already has. A three-person finance team can close the books faster, a small sales team can cover more territory, and a lean service desk can resolve tickets that used to sit in a queue.
The companies that benefit most from AI are the least equipped to govern it. AI adoption is moving at an enterprise pace, while IT capacity remains aligned with a midmarket budget. That mismatch is the midmarket AI gap, and it’s widening.
Even the big guys are struggling
ZK Research recently surveyed 400 U.S. CISOs and security decisionmakers about how they’re handling generative AI and shadow AI. Every company in the study has at least 1,000 employees, and each already uses a mobile threat defense or mobile device management platform. These are well-resourced security teams, but they are underwater.
Organizations estimate that their employees use an average of 27 AI-powered applications, and 14% report using more than 50. Sixty-five percent say employee AI adoption is outpacing their ability to govern it. Sixty-three percent have investigated an incident in the past year in which generative AI contributed to attempted or successful theft or a leak of sensitive data.
If that’s the picture at companies with dedicated CISOs, consider the 300-person manufacturer where “the security team” is just two or three people who reset passwords, manage the firewall, and run the Microsoft 365 tenant. The risks don’t shrink with company size. The headcount does.
Policy is not control
The most telling finding is the gap between what organizations believe and what they can enforce. Ninety-eight percent have a formal acceptable use policy for generative AI, but only 47% enforce it using AI-aware tools such as DLP or CASB. Twenty-nine percent rely on legacy URL filtering, and 23% rely on an honor system with no technical blocking.
A policy that can’t be enforced is a liability document, not a security control. It tells you what employees shouldn’t do, not what they’re doing. Visibility follows the same pattern. Eighty-seven percent are confident in their count of AI applications, yet only two-thirds can see the specific data being uploaded to unsanctioned AI tools in real time. That’s like knowing which doors in the building are open without knowing what’s walking out of them.
The attack surface moved
Three trends are making this harder, and each disproportionately affects small teams. The first is mobile. Respondents estimate that 44% of employee AI interactions occur on mobile devices, yet only 20% report that their MTD or MDM tools provide granular visibility into data flowing between enterprise apps and AI assistants.
The second is SaaS-connected AI agents. On average, 36.7% of core SaaS tools, such as Slack, Zoom, and Salesforce, have been connected to third-party AI agents without formal IT review. Some 89% of security leaders are concerned about “shadow permissions,” in which an agent inherits an employee’s access to systems like OneDrive or Salesforce. An agent with a user’s permissions and no owner never appears in a traditional asset inventory.
The third is compliance and response. Only 35% claim full readiness to produce an auditable inventory of the AI models in use, and just 54% have a dedicated AI data-leak playbook.
Why the midmarket feels it more
None of these problems is unique to smaller companies. What’s different is the operating math. Respondents are allocating an average of 19% of their 2026 security budgets to AI governance, visibility, and compliance. Most midmarket teams don’t have a budget line for AI governance, let alone a dedicated person to own it. The work gets layered on top of everything else and is handled reactively, if at all.
That creates a second-order problem. Eighty-four percent of security leaders have delayed or blocked a business-led AI initiative because they couldn’t verify its security or compliance posture, and half of those killed it outright. In a large enterprise, a stalled project is an annoyance. In a midmarket company, blocking AI because you can’t govern it means surrendering the productivity advantage that makes AI valuable in the first place. The answer can’t be “no.” It has to be “yes, safely.”
The gap also appears in incidents. Among organizations that say adoption is outpacing governance, 77% have investigated an AI-linked incident, compared with 37% of those where governance is keeping up.
What IT pros should do now
The goal isn’t to replicate an enterprise AI governance program. It’s to implement the highest-leverage controls and treat governance as an ongoing operation rather than a project. Here’s where I would start:
- Build a real inventory, not an estimate. Use identity logs, SaaS admin consoles, OAuth grant reports, and endpoint telemetry to find which AI apps and agents are actually in use. Expect the number to be higher than you think.
- Audit agent permissions first. Every AI connector attached to a core SaaS platform should have a named human owner, a business justification, and a fast way to revoke it.
- Move from honor system to enforcement. Prioritize data-aware controls that see what’s being shared, not just where traffic is going.
- Don’t forget the phone. Extend AI policies to managed and BYOD devices, and pressure-test what your MDM or MTD platform can actually see.
- Write the AI incident playbook now. Define who gets called, what gets logged, and how you contain an AI-related leak before you need it.
- Give the business a sanctioned path. Shadow AI thrives when the approved option is slower or doesn’t exist.
Know when to bring in help
Even with a tight plan, most midmarket teams can’t sustain this alone. AI governance requires continuous monitoring, permission reviews, mobile and endpoint management, a security operations function that responds at 2 a.m., and periodic compliance assessments. That’s an enterprise-sized job.
This is where an MSP or MSSP earns its keep. The right partner doesn’t replace the internal team; it extends it, much as AI extends the workforce.
Dataprise is among the companies offering these services to the midmarket, so I reached out to Scott Brindamour, the company’s chief strategy officer, for his perspective on what he’s hearing from customers.
“The midmarket IT leaders we talk to aren’t asking whether to use AI. They’re asking how to say yes without losing control of their data,” Brindamour told me. “Their teams are already stretched running the environment day to day, and AI governance doesn’t fit neatly into anyone’s job description. It touches the endpoint, the phone, the SaaS stack, identity, and the SOC all at once. What these organizations need is a partner that can give them visibility across it all, turn policy into enforcement, and be there around the clock when something goes wrong.”
When evaluating a partner, ask three questions. Can they give me visibility into AI usage across endpoints, mobile, and SaaS? Can they help me enforce policy, not just write it? Can they provide the 24/7 detection and response my team can’t staff?
AI is the best opportunity in years for smaller companies to compete above their weight class, but that advantage holds only if governance keeps pace with adoption. For most midmarket IT teams, closing the gap starts with admitting they can’t do it alone and finding a partner who helps them say yes to AI without betting the business on it.
