CoChat
Sign Up
PreprintCited by 8Information and Cyber SecurityCybercrime and Law Enforcement StudiesPrivacy, Security, and Data Protection

The DOI matches its DataCite record; 2 of the 2 references it cites were found in a registry or an index.

Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity

Open access
Junior, Carlos Rombaldo, Becker, Ingolf, Johnson, Shane·2023·arXiv
DOI 10.48550/arxiv.2309.17186arXiv 2309.17186
Open this paper in CoChat — free account

Abstract

Small and medium enterprises (SMEs) are pivotal in the global economy, accounting for over 90% of businesses and 60% of employment worldwide. Despite their significance, SMEs are often disregarded in cybersecurity initiatives, rendering them ill-equipped to deal with the growing frequency, sophistication, and destructiveness of cyberattacks. We systematically reviewed the cybersecurity literature on SMEs published between 2017 and 2024. We focused on research discussing cyber threats, adopted controls, challenges, and constraints SMEs face in pursuing cybersecurity resilience. Our search yielded 1090 studies that we narrowed to 132 relevant papers. We identified 44 unique themes and categorised them as novel findings or established knowledge. This distinction revealed that research on SMEs is underdeveloped and has made little progress in understanding SMEs' roles, threats, and needs. Studies often repeated early discoveries without replicating or offering new insights. Existing research indicates that the main challenges to attaining cybersecurity resilience of SMEs are a lack of awareness of cybersecurity risks, limited cybersecurity literacy, and constrained financial resources. Resource availability varied between developed and developing countries. Our analysis indicated a relationship among these themes, suggesting that limited literacy is the root cause of awareness and resource constraint issues.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2309.17186

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Brownfield networks continue to anchor connectivity in SMEs because rewiring or wholesale equipment replacement is cost-prohibitive and operationally risky.

    “Brownfield networks continue to anchor connectivity in SMEs because rewiring or wholesale equipment replacement is cost-prohibitive and operationally risky [2,3].”

    From Low-Capital Expenditure AI-Assisted Zero-Trust Control Plane for Brownfield Ethernet Environments (2026) · cites this paper as [3]

    The ‘Lack of tailored solutions and frameworks’ section (p. 13) identifies infrastructure requirements and financial costs as barriers for SMEs, including the cost of acquiring new technologies. It does not say that brownfield networks remain in use, or that rewiring and equipment replacement are cost-prohibitive or operationally risky. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 148

  1. [1]1. Holt TJ. The evolution of cybercrime, 2006-2016. In Cybercrime Through an Interdisciplinary Lens , volume 1, pages 29-50. Routledge, December 2016. doi: 10.4324/9781315618456-9 . · DOI
  2. [3]3. Huaman N, von Skarczinski BS, Stransky C, Wermke D, Acar Y, Dreißigacker A, Fahl S. A large-scale interview study on information security in and attacks against small and medium-sized enterprises. In 30th USENIX Security Symposium, USENIX Security 2021 , pages 1235-1252. USENIX Association, 2021.
  3. [6]6. Cleveland J, Scheg A. Small-Medium Business Information Security Intention Related to Cyberthreat Awareness: A Quantitative Experiment . PhD thesis, Northcentral University, Ann Arbor, 2018.
  4. [7]7. Pickering B, Boletsis C, Halvorsrud R, Phillips S, Surridge M. It's not my problem: How healthcare models relate to SME cybersecurity awareness, Cham, Springer International Publishing, 2021. doi: 10.1007/978-3-030-77392-2 22 . · DOI
  5. [8]8. Alahmari A, Duncan B. Cybersecurity risk management in small and medium-sized enterprises: A systematic review of recent evidence. 2020 International Conference on Cyber Situational Awareness, Data Analytics and Assessment, Cyber SA 2020 . June 2020. doi: 10.1109/cybersa49311.2020.9139638 . · DOI
  6. [10]10. McLilly L, Qu Y. Quantitatively examining service requests of a cloud-based on-demand cybersecurity service solution for small businesses. Proceedings - 2020 International Conference on Computational Science and Computational Intelligence, CSCI 2020 . 2020;pages 116-121. doi: 10.1109/csci51800.2020.00027 . · DOI
  7. [11]11. Heidt M, Gerlach J, Buxmann P. Investigating the security divide between SME and large companies: How SME characteristics influence organizational IT security investments. Information Systems Frontiers . December 2019;21(6):1285-1305. doi: 10.1007/ s10796-019-09959-1 .
  8. [12]12. Johannsen A, Kant D, Creutzburg R. Measuring IT security, compliance and data governance within small and medium-sized IT enterprises. Electronic Imaging . January 2020;32(3):1-11. doi: 10.2352/issn.2470-1173.2020.3.mobmu-252 . · DOI
  9. [13]13. Ahmed NN, Nanath K. Exploring cybersecurity ecosystem in the middle east: Towards an SME recommender system. Journal of Cyber Security and Mobility . 2021;10(3):511-536. doi: 10.13052/jcsm2245-1439.1032 . · DOI
  10. [14]14. Kabanda S, Tanner M, Kent C. Exploring SME cybersecurity practices in developing countries. Journal of Organizational Computing and Electronic Commerce . 2018;28(3):269-282.
  11. [17]17. Alahmari AA, Duncan RA. Investigating potential barriers to cybersecurity risk management investment in SMEs. Proceedings of the 13th International Conference on Electronics, Computers and Artificial Intelligence, ECAI 2021 . July 2021;13:1-6. doi: 10.1109/ecai52376.2021.9515166 . · DOI
  12. [18]18. Ikuero F, Zeng W. Improving cybersecurity incidents reporting in nigeria: micro and small enterprises perspectives, June 2022. doi: 10.4314/njt.v41i3.10 . · DOI
  13. [19]19. White GRT, Allen RA, Samuel A, Abdullah A, Thomas R. Antecedents of cybersecurity implementation: A study of the cyberpreparedness of u.k. social enterprises, 2020. doi: 10.1109/tem.2020.2994981 . · DOI
  14. [20]20. Imsand E, Tucker B, Paxton J, Graves S. A survey of cyber security practices in small businesses. In Advances in Intelligent Systems and Computing , volume 1055, pages 44-50. Springer, 2020. doi: 10.1007/978-3-030-31239-8 4 . · DOI
  15. [21]21. Mitrofan AL, CRUCERU EV, BARBU A. Determining the main causes that lead to cybersecurity risks in smes. Business Excellence and Management . 2020;10(4):38-48. doi: 10.24818/beman/2020.10.4-03 . · DOI
  16. [22]22. Carias JF, Arrizabalaga S, Labaka L, Hernantes J. Cyber resilience self-assessment tool (CR-SAT) for SMEs. IEEE Access . 2021;9: 80741-80762. doi: 10.1109/access.2021.3085530 . · DOI
  17. [24]24. Saban KA, Rau SE, Wood CA. 'SME executives' perceptions and the information security preparedness model'. Information and Computer Security . 2021;29(2):263-282. doi: 10.1108/ics-01-2020-0014 . · DOI
  18. [25]25. Ncubukezi T, Mwansa L, Rocaries F. A review of the current cyber hygiene in small and medium-sized businesses. In 2020 15th International Conference for Internet Technology and Secured Transactions, ICITST 2020 , pages 1-6. IEEE, 2020. doi: 10.23919/icitst51030.2020.9351339 . · DOI
  19. [26]26. Lejaka TK, Veiga AD, Loock M. Cyber security awareness for small, medium and micro enterprises (SMMEs) in south africa. 2019 Conference on Information Communications Technology and Society, ICTAS 2019 . April 2019;pages 1-6. doi: 10.1109/ ictas.2019.8703609 .
  20. [27]27. Elezaj O, Yayilgan SY, Abomhara M, Yeng P, Ahmed J. Data-driven intrusion detection system for small and medium enterprises, 2019. doi: 10.1109/camad.2019.8858166 . · DOI
  21. [28]28. Ozkan BY, Spruit M. Cybersecurity standardisation for SMEs: The stakeholders' perspectives and a research agenda, 2019. doi: 10.4018/IJSR.20190701.oa1 . · DOI
  22. [29]29. Kljuˇ cnikov A, Mura L, Sklen´ ar D. Information security management in SMEs: factors of success. Entrepreneurship and Sustainability Issues . 2019;6(4):2081-2094. doi: 10.9770/jesi.2019.6.4(37) . · DOI
  23. [30]30. Raineri EM, Resig J. Evaluating self-efficacy pertaining to cybersecurity for small businesses. The Journal of Applied Business and Economics . 2020;22(12):13-23. doi: 10.33423/jabe.v22i12.3876 . · DOI
  24. [35]35. Eilts D. An Empirical Assessment of Cybersecurity Readiness and Resilience in Small Businesses . PhD thesis, Nova Southeastern University, Ann Arbor, 2020.
  25. [36]36. Higgins JP, Thomas J, Chandler J, Cumpston M, Li T, Page MJ, Welch VA. Cochrane Handbook for Systematic Reviews of Interventions . Wiley, September 2019. doi: 10.1002/9781119536604 . · DOI · Paper page
  26. [37]37. Tranfield D, Denyer D, Smart P. Towards a methodology for developing evidence-informed management knowledge by means of systematic review, 2003. doi: 10.1111/1467-8551.00375 . · DOI · Paper page
  27. [38]38. Braun V, Clarke V. Using thematic analysis in psychology. Qualitative Research in Psychology . January 2008;3(2):77-101. doi: 10.1191/1478088706qp063oa . · DOI · Paper page
  28. [39]39. Weisburd D, Farrington DP, Gill C, Ajzenstadt M, Bennett T, Bowers K, Caudy MS, Holloway K, Johnson S, L¨ osel F, Mallender J, Perry A, Tang LL, Taxman F, Telep C, Tierney R, Ttofi MM, Watson C, Wilson DB, Wooditch A. What works in crime prevention and rehabilitation: An assessment of systematic reviews. Criminology and Public Policy . 2017;16(2):415-449. doi: 10.1111/1745-9133.12298 . · DOI
  29. [40]40. Blythe JM, Johnson SD. A systematic review of crime facilitated by the consumer internet of things. Security Journal . March 2021;34(1):97-125. doi: 10.1057/s41284-019-00211-8 . · DOI
  30. [41]41. Moher D, Shamseer L, Clarke M, Ghersi D, Liberati A, Petticrew M, Shekelle P, Stewart LA, Estarli M, Barrera ES, Mart´ ınezRodr´ ıguez R, Baladia E, Ag¨ uero SD, Camacho S, Buhring K, Herrero-L´ opez A, Gil-Gonz´ alez DM, Altman DG, Booth A, Chan AW, Chang S, Clifford T, Dickersin K, Egger M, Gøtzsche PC, Grimshaw JM, Groves T, Helfand M, Higgins J, Lasserson T, Lau J, Lohr K, McGowan J, Mulrow C, Norton M, Page M, Sampson M, Sch¨ unemann H, Simera I, Summerskill W, Tetzlaff J, Trikalinos TA, Tovey D, Turner L, Whitlock E. Preferred reporting items for systematic review and meta-analysis protocols (PRISMA-p) 2015 statement. Revista Espanola de Nutricion Humana y Dietetica . December 2016;20(2):148-160. doi: 10.1186/2046-4053-4-1 . · DOI · Paper page
  31. [42]42. Richardson WS, Wilson MC, Nishikawa J, Hayward R. The well-built clinical question: a key to evidence-based decisions. ACP journal club . November 1995;123(3):A12-A13. doi: 10.7326/acpjc-1995-123-3-a12 . · DOI · Paper page
  32. [46]46. Rawindaran N, Jayal A, Prakash E, Hewage C. Cost benefits of using machine learning features in NIDS for cyber security in UK small medium enterprises (SME). Future Internet . January 2021;13(8):186. doi: 10.3390/fi13080186 . · DOI
  33. [47]47. Grondys K, ´ Slusarczyk O, Hussain HI, Androniceanu A. Risk assessment of the SME sector operations during the COVID-19 pandemic, 2021. doi: 10.3390/ijerph18084183 . · DOI
  34. [48]48. Feh´ er DJ. Cybersecurity threats of cloud and third-party services in small and medium-sized enterprise environment. Management, Enterprise and Benchmarking in the 21st Century . 2020;pages 36-41.
  35. [50]50. Ratajczyk E, Brady U, Baggio JA, Barnett AJ, Perez-Ibara I, Rollins N, Rubi˜ nos C, Shin HC, Yu DJ, Aggarwal R, Anderies JM, Janssen MA. Challenges and opportunities in coding the commons: problems, procedures, and potential solutions in large-n comparative case studies. International Journal of the Commons . September 2016;10(2):440-466. doi: 10.18352/ijc.652 . · DOI
  36. [51]51. Byrt T, Bishop J, Carlin JB. Bias, prevalence and kappa. Journal of Clinical Epidemiology . May 1993;46(5):423-429. doi: 10.1016/0895-4356(93)90018-v . · DOI · Paper page
  37. [52]52. Ouzzani M, Hammady H, Fedorowicz Z, Elmagarmid A. Rayyan-a web and mobile app for systematic reviews. Systematic Reviews . 2016;5(1):210. doi: 10.1186/s13643-016-0384-4 . · DOI · Paper page
  38. [54]54. Vaismoradi M, Snelgrove S. Theme in qualitative content analysis and thematic analysis. Forum Qualitative Sozialforschung . September 2019;20(3):23. doi: 10.17169/fqs-20.3.3376 . · DOI
  39. [55]55. Braun V, Clarke V. One size fits all? what counts as quality practice in (reflexive) thematic analysis? Qualitative Research in Psychology . July 2021;18(3):328-352. doi: 10.1080/14780887.2020.1769238 . · DOI · Paper page
  40. [56]56. Dykstra J, Mathur R, Spoor A. Cybersecurity in medical private practice: Results of a survey in audiology. In 2020 IEEE 6th International Conference on Collaboration and Internet Computing (CIC) , pages 169-176, Piscataway, NJ, 2020. IEEE. doi: 10.1109/CIC50333.2020.00029 . · DOI
  41. [57]57. L¨ offler E, Schneider B, Zanwar T, Asprion PM. Cysecescape 2.0 -a virtual escape room to raise cybersecurity awareness. International Journal of Serious Games . January 2021;8(1):59-70. doi: 10.17083/ijsg.v8i1.413 . · DOI
  42. [58]58. Rae A, Patel A. Defining a new composite cybersecurity rating scheme for SMEs in the u.k., School of Computing and Digital Technologies, Staffordshire University, Stoke-on-Trent, United Kingdom, Springer, 2019. doi: 10.1007/978-3-030-34339-2 20 . · DOI
  43. [60]60. Bada M, Nurse JRC. Developing cybersecurity education and awareness programmes for small- and medium-sized enterprises (SMEs), January 2019. doi: 10.1108/ics-07-2018-0080 . · DOI
  44. [61]61. Nasir S, Vajjhala NR. Evaluating information security awareness and compliance in sub-saharan africa: An interpretivist perspective. Proceedings of the 13th IADIS International Conference Information Systems 2020, IS 2020 . 2020;13:187-190. doi: 10.33965/ is2020 202006r025 .
  45. [62]62. Bailetti T, Craigen D. Examining the relationship between cybersecurity and scaling value for new companies. Technology Innovation Management Review . 2020;10(2):62-70. doi: 10.22215/timreview/1329 . · DOI
  46. [63]63. Almubayedh D, Khalis MA, Alazman G, Alabdali M, Al-Refai R, Nagy N. Security related issues in saudi arabia small organizations: A saudi case study. 21st Saudi Computer Society National Computer Conference, NCC 2018 . December 2018;21:1-6. doi: 10.1109/ncg.2018.8593058 . · DOI
  47. [64]64. Carias JF, Borges MRS, Labaka L, Arrizabalaga S, Hernantes J. Systematic approach to cyber resilience operationalization in SMEs, 2020. doi: 10.1109/access.2020.3026063 . · DOI
  48. [65]65. Alharbi FD, Alsulami MH, AL-Solami A, Al-Otaibi Y, Al-Osimi M, Al-Qanor F, Al-Otaibi K. The impact of cybersecurity practices on cyberattack damage: The perspective of small enterprises in saudi arabia, 2021. doi: 10.3390/s21206901 . · DOI
  49. [66]66. Gafni R, Pavel T. The invisible hole of information on SMB's cybersecurity. Online Journal of Applied Knowledge Management . 2019;7(1):14-26.
  50. [67]67. Yudhiyati R, Putritama A, Rahmawati D. What small businesses in developing country think of cybersecurity risks in the digital age: Indonesian case. Journal of Information, Communication and Ethics in Society . January 2021;19(4):446-462. doi: 10.1108/jices-03-2021-0035 . · DOI
  51. [68]68. Gamisch L, P¨ ohn D. A study of different awareness campaigns in a company. In Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES '23) . Association for Computing Machinery, 2023. doi: 10.1145/3600160.3605006 . · DOI
  52. [69]69. Chidukwani A, Zander S, Koutsakis P. A survey on the cyber security of small-to-medium businesses: Challenges, research focus and recommendations. IEEE Access . 2022;10:85701-85719. doi: 10.1109/access.2022.3197899 . · DOI
  53. [70]70. Ogunyebi O, Swar B, Aghili S. An incident handling guide for small organizations in the hospitality sector. In Trends and Advances in Information Systems and Technologies (WorldCIST'18) , volume 745 of Advances in Intelligent Systems and Computing , pages 232-241. Springer, 2018. doi: 10.1007/978-3-319-77703-0 45 . · DOI
  54. [71]71. Mmango N, Gundu T. Cyber resilience in the entrepreneurial environment: A framework for enhancing cybersecurity awareness in SMEs. In 2023 International Conference on Electrical, Computer and Energy Technologies (ICECET) , pages 1-6, Piscataway, NJ, 2023. IEEE. doi: 10.1109/ICECET58911.2023.10389226 . · DOI
  55. [72]72. Asprion PM, Gossner P, Schneider B. Cybersecurity governance -an adapted practical framework for small enterprises. In Proceedings of the 56th Hawaii International Conference on System Sciences (HICSS-56) , volume 2023, pages 5928-5937, Honolulu, HI, 2023. HICSS. doi: 10.24251/HICSS.2023.720 . · DOI
  56. [73]73. D´ ıaz Piraquive FN, de Jes´ us Muriel Perea Y, Gonz´ alez-Crespo R. Cybersecurity management in micro, small, and medium enterprises in colombia. Communications in Computer and Information Science . 2023;1825:74-85. doi: 10.1007/ 978-3-031-34045-1 8 .
  57. [74]74. Shojaifar A, Fricker S. Design and evaluation of a self-paced cybersecurity tool. Information and Computer Security . 2023;31(2): 244-262. doi: 10.1108/ICS-09-2021-0145 . · DOI
  58. [75]75. H¨ arting RC, Schulz GN, Deffner D, Karg C. Digital transformation and cyber threats for small and medium sized enterprises. In Agents and Multi-agent Systems: Technologies and Applications 2023 (KES-AMSTA 2023) , volume 354 of Smart Innovation, Systems and Technologies , pages 161-170, Singapore, 2023. Springer. doi: 10.1007/978-981-99-3068-5 15 . · DOI
  59. [76]76. Almoaigel MF, Abuabid A. Implementation of cybersecurity situation awareness model in saudi SMEs. International Journal of Advanced Computer Science and Applications . 2023;14(11). doi: 10.14569/IJACSA.2023.01411110 . · DOI
  60. [77]77. Moeti MN, Langa MR, Sigama K. Information security framework adoption for south african small and medium enterprise. In Digital-for-Development: Enabling Transformation, Inclusion and Sustainability Through ICTs (IDIA 2022) , volume 1774 of Communications in Computer and Information Science , pages 218-233, Cham, 2023. Springer. doi: 10.1007/ 978-3-031-28472-4 14 .
  61. [78]78. Eybers S, Mvundla Z. Investigating cyber security awareness (CSA) amongst managers in small and medium enterprises (SMEs). In Comprehensible Science (ICCS 2021) , volume 315 of Lecture Notes in Networks and Systems , pages 180-191, Cham, 2022. Springer. doi: 10.1007/978-3-030-85799-8 16 . · DOI
  62. [79]79. Neri M, Niccolini F, Martino L. Organizational cybersecurity readiness in the ICT sector: a quanti-qualitative assessment. Information and Computer Security . 2024;32(1):38-52. doi: 10.1108/ICS-05-2023-0084 . · DOI
  63. [80]80. Al-Somali SA, Saqr RR, Asiri AM, Al-Somali NA. Organizational cybersecurity systems and sustainable business performance of small and medium enterprises (SMEs) in saudi arabia: The mediating and moderating role of cybersecurity resilience and organizational culture. Sustainability . 2024;16(5):1880. doi: 10.3390/su16051880 . · DOI
  64. [81]81. Shojaifar A, Fricker S. SMEs' confidentiality concerns for security information sharing. In Human Aspects of Information Security and Assurance (HAISA 2020) , volume 593 of IFIP Advances in Information and Communication Technology , pages 289-299, Cham, 2020. Springer. doi: 10.1007/978-3-030-57404-8 22 . · DOI
  65. [82]82. Oroni CZ, Xianping F. Structural evaluation of management capability and the mediation role of cybersecurity awareness towards enterprise performance. Journal of Data, Information and Management . 2023;5(4):345-361. doi: 10.1007/s42488-023-00108-7 . · DOI
  66. [83]83. Ponsard C, Grandclaudon J. Survey and guidelines for the design and deployment of a cyber security label for SMEs. In 4th International Conference on Information Systems Security and Privacy, ICISSP 2018 , volume 977, 2019. doi: 10.1007/ 978-3-030-25109-3 13 .
  67. [84]84. Scholl M. Sustainable information security sensitization in SMEs: Designing measures with long-term effect. In Proceedings of the 56th Hawaii International Conference on System Sciences (HICSS-56) , volume 2023, pages 6058-6067, Honolulu, HI, 2023. HICSS. doi: 10.24251/HICSS.2023.735 . · DOI
  68. [85]85. Heidt M, Gerlach J. The influence of SME constraints on organizational IT security. In Proceedings of the 39th International Conference on Information Systems (ICIS 2018) , page paper 7, Atlanta, GA, 2018. Association for Information Systems.
  69. [86]86. Mokwetli M, Zuva T. Adoption of the ICT security culture in SMME's in the gauteng province, south africa. 2018 International Conference on Advances in Big Data, Computing and Data Communication Systems, icABCD 2018 . 2018;pages 1-7. doi: 10.1109/icabcd.2018.8465139 . · DOI
  70. [87]87. Heidenreich M. Conceptualization of a measurement method proposal for the assessment of IT security in the status quo of micro-enterprises. In Proceedings - 2019 International Conference on Computing, Electronics and Communications Engineering, iCCECE 2019 , pages 187-192. IEEE, 2019. doi: 10.1109/iccece46942.2019.8941688 . · DOI
  71. [88]88. Teymourlouei H, Harris V. Effective methods to monitor IT infrastructure security for small business. In 2019 International Conference on Computational Science and Computational Intelligence (CSCI) , pages 7-13, 2019. doi: 10.1109/csci49370.2019. 00009 . · DOI
  72. [89]89. Ulrich P, Frank V, Timmermann A. The dark side of data science - an empirical study of cyber risks in german SMEs. 24th KES International Conference on Knowledge-Based and Intelligent Information and Engineering Systems, KES 2020 . 2020;176: 2615-2624. doi: 10.1016/j.procs.2020.09.307 . · DOI
  73. [90]90. Erdogan G, Halvorsrud R, Boletsis C, Tverdal S, Pickering JB. Cybersecurity awareness and capacities of SMEs. In International Conference on Information Systems Security and Privacy , pages 296-304, 2023. doi: 10.5220/0011609600003405 . · DOI
  74. [91]91. Rawindaran N, Nawaf L, Alarifi S, Alghazzawi D, Carroll F, Katib I, Hewage C. Enhancing cyber security governance and policy for SMEs in industry 5.0: A comparative study between saudi arabia and the united kingdom. Digital . 2023;3(3):200-231. doi: 10.3390/digital3030014 . · DOI · Paper page
  75. [92]92. Ncubukezit T. Human errors: A cybersecurity concern and the weakest link to small businesses. International Conference on Cyber Warfare and Security . 2022;17(1):395-403. doi: 10.34190/iccws.17.1.51 . · DOI
  76. [93]93. Nkhoma M, Thien DDP, Hoai TL, Nkhoma C. Information security landscape in vietnam: Insights from two research surveys. In Jahankhani H, editor, Cyber Criminology , Advanced Sciences and Technologies for Security Applications, pages 341-357. Springer, Cham, 2018. doi: 10.1007/978-3-319-97181-0 17 . · DOI
  77. [94]94. Sia NC, Hosseinian-Far A, Toe TT. Reasons behind poor cybersecurity readiness of singapore's small organizations: Reveal by case studies. In Jahankhani H, Jamal A, Lawson S, editors, Cybersecurity, Privacy and Freedom Protection in the Connected World , Advanced Sciences and Technologies for Security Applications, pages 269-283. Springer, Cham, 2021. doi: 10.1007/ 978-3-030-68534-8 17 .
  78. [97]97. Barlette Y, Jaouen A. Information security in SMEs: determinants of CEOs' protective and supportive behaviors, 2019. doi: 10.3917/sim.193.0007 . · DOI
  79. [98]98. Chandra NA, Sadikin M. ISM application tool, a contribution to address the barrier of information security management system implementation. Journal of Information and Communication Convergence Engineering . 2020;18(1):39-48. doi: 10.6109/jicce. 2020.18.1.39 . · DOI
  80. [99]99. Ozkan BY, Spruit M, Wondolleck R, Coll VB. Modelling adaptive information security for SMEs in a cluster, 2020. doi: 10.1108/jic-05-2019-0128 . · DOI
  81. [100]100. Young JA. The development of a red teaming service-learning course. Journal of Information Systems Education . 2020;31(3): 157-178. doi: 10.62273/NBAD8142 . · DOI
  82. [101]101. Bountouni N, Koussouris S, Vasileiou A, Kazazis SA. A holistic framework for safeguarding of SMEs: A case study. In 2023 19th International Conference on the Design of Reliable Communication Networks (DRCN) . IEEE, 2023. doi: 10.1109/DRCN57075. 2023.10108247 . · DOI
  83. [102]102. Auyporn W, Piromsopa K, Chaiyawat T. A study of distinguishing factors between SME adopters versus non-adopters of cybersecurity standard. International Journal of Computing and Digital Systems . 2023;13(1):671-680. doi: 10.12785/ijcds/ 130153 . · DOI
  84. [103]103. Berry CT, Berry R. An initial assessment of small business risk management approaches for cyber security threats. International Journal of Business Continuity and Risk Management . 2018;8(1). doi: 10.1504/IJBCRM.2018.090580 . · DOI
  85. [105]105. Tsiodra M, Panda S, Chronopoulos M, Panaousis E. Cyber risk assessment and optimization: A small business case study. IEEE Access . 2023;11:44467-44481. doi: 10.1109/ACCESS.2023.3272670 . · DOI
  86. [106]106. Franco MF, Granville LZ, Stiller B. CyberTEA: a technical and economic approach for cybersecurity planning and investment. In NOMS 2023 - 2023 IEEE/IFIP Network Operations and Management Symposium , pages 1-6, Piscataway, NJ, 2023. IEEE. doi: 10.1109/noms56928.2023.10154307 . · DOI
  87. [107]107. Roy A, Patil K. Framework for cloud security initiatives in small and medium-sized enterprises. In 2023 International Conference on Advancement in Computation & Computer Technologies (InCACCT) , pages 444-449, Piscataway, NJ, 2023. IEEE. doi: 10.1109/InCACCT57535.2023.10141743 . · DOI
  88. [108]108. Jamil H, Zia T, Nayeem T, Whitty MT, D'Alessandro S. Human-centric cyber security: Applying protection motivation theory to analyse micro business owners' security behaviours. Information and Computer Security . 2024;33:49-76. doi: 10.1108/ ICS-10-2023-0176 .
  89. [109]109. Pickering B, Phillips SC, Erdogan G. I just want to help: SMEs engaging with cybersecurity technology. In Moallem A, editor, HCI for Cybersecurity, Privacy and Trust (HCII 2023) , volume 14045 of Lecture Notes in Computer Science , pages 338-352. Springer, Cham, 2023. doi: 10.1007/978-3-031-35822-7 23 . · DOI
  90. [110]110. Wilson M, McDonald S, Button D, McGarry K. It won't happen to me: Surveying SME attitudes to cyber-security. Journal of Computer Information Systems . 2023;63(2):397-409. doi: 10.1080/08874417.2022.2067791 . · DOI
  91. [111]111. Aigbefo Q, Blount Y, Marrone M. The influence of hardiness and habit on security behaviour intention. Behaviour & Information Technology . 2022;41(6):1151-1170. doi: 10.1080/0144929X.2020.1856928 . · DOI
  92. [112]112. Lejaka TK, da Veiga A, Loock M. Towards roles and responsibilities in a cyber security awareness framework for south african small, medium, and micro enterprises (SMMEs). In Human Aspects of Information Security and Assurance (HAISA 2023) , volume 674 of IFIP Advances in Information and Communication Technology , pages 211-224, Cham, 2023. Springer. doi: 10.1007/978-3-031-38530-8 17 . · DOI
  93. [113]113. Tam T, Rao A, Hall J. The good, the bad and the missing: A narrative review of cyber-security implications for australian small businesses. Computers & Security . 2021;109:102385. doi: 10.1016/j.cose.2021.102385 . · DOI
  94. [114]114. Brunner M, Mussmann A, Breu R. Introduction of a tool-based continuous information security management system: An exploratory case study. In 2018 IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C) , pages 483-490, Piscataway, NJ, July 2018. IEEE. doi: 10.1109/qrs-c.2018.00088 . · DOI
  95. [115]115. Dimitrov W, Rasheva-Yordanova K, Konstantinov O, Bosakova K, Angelova V. Toward overcoming the disproportion between the demand for professionals and the provision of training in cybersecurity. EDULEARN19 Proceedings . July 2019;1:1656-1664. doi: 10.21125/edulearn.2019.0485 . · DOI
  96. [116]116. Carias JF, Arrizabalaga S, Hernantes J. Cyber resilience strategic planning and self-assessment tool for operationalization in SMEs. In Information Technology in Disaster Risk Reduction (ITDRR 2020) , volume 622 of IFIP Advances in Information and Communication Technology , pages 259-273, Cham, 2021. Springer. doi: 10.1007/978-3-030-81469-4 21 . · DOI
  97. [117]117. Ponsard C, Grandclaudon J, Point N. Methodology and feedback about systematic cybersecurity experts auditing in belgium. In Proceedings of the 6th International Conference on Information Systems Security and Privacy (ICISSP 2020) , pages 754-759, Set´ ubal, Portugal, 2020. SciTePress. doi: 10.5220/0009190307540759 . · DOI
  98. [118]118. Ruhwanya Z, Ophoff J. Information security culture assessment of small and medium-sized enterprises in tanzania. In Information and Communication Technologies for Development. Strengthening Southern-Driven Cooperation as a Catalyst for ICT4D (ICT4D 2019) , volume 551 of IFIP Advances in Information and Communication Technology , pages 776-788, Cham, 2019. Springer. doi: 10.1007/978-3-030-18400-1 63 . · DOI
  99. [119]119. Rodriguez-Baca LS, Larrea-Serqu´ en RL, Cruzado CF, Alarcon-Diaz M, Garcia-Hernandez SE, Pebe-Espinoza J. Business cybersecurity. case study in peruvian and mexican SMEs. In 2022 3rd International Conference for Emerging Technology (INCET) , pages 1-6, Piscataway, NJ, 2022. IEEE. doi: 10.1109/INCET54531.2022.9824900 . · DOI
  100. [120]120. Azinheira B, Antunes M, Maximiano M, Gomes RP. Information security and cybersecurity assessment in SME - an implementation methodology. Journal of Global Business and Technology . 2023;19(1):78-95.
  101. [121]121. Cruzado CF, Rodriguez-Baca LS, Huanca-Lopez LG, Acuna-Salinas EI. Reference framework 'HOGO' for cybersecurity in SMEs based on ISO 27002 and 27032. In 2022 12th International Conference on Cloud Computing, Data Science & Engineering (Confluence) , pages 35-40, Piscataway, NJ, 2022. IEEE. doi: 10.1109/Confluence52989.2022.9734116 . · DOI
  102. [122]122. Park H, Yoo Y, Lee H. 7s model for technology protection of organizations. Sustainability (Switzerland) . 2021;13(13):7020. doi: 10.3390/su13137020 . · DOI
  103. [123]123. Alghamdi F, Hamza N, Tamimi M. Factors that influence the adoption of information security on requirement phase for custommade software at SMEs. 2nd International Conference on Computer Applications and Information Security, ICCAIS 2019 . May 2019;2:1-5. doi: 10.1109/cais.2019.8769519 . · DOI
  104. [124]124. Katt B, Prasher N. Quantitative security assurance metrics: REST API case studies. In Proceedings of the 12th European Conference on Software Architecture: Companion Proceedings (ECSA '18) , New York, NY, USA, September 2018. Association for Computing Machinery. doi: 10.1145/3241403.3241464 . · DOI
  105. [125]125. AL-Dosari K, Fetais N. Risk-management framework and information-security systems for small and medium enterprises (SMEs): A meta-analysis approach. Electronics . 2023;12(17). doi: 10.3390/electronics12173629 . · DOI
  106. [126]126. Durowoju O, Chan HK, Wang X. Investigation of the effect of e-platform information security breaches: A small and medium enterprise supply chain perspective, 2020. doi: 10.1109/tem.2020.3008827 . · DOI
  107. [127]127. Gonz´ alez DP, Trigueros-Preciado S, Gonz´ alez PS. Organizational practices as antecedents of the information security management performance, 2019. doi: 10.1108/itp-06-2018-0261 . · DOI
  108. [128]128. Jantti M. Studying data privacy management in small and medium-sized IT companies. Proceedings of the 2020 14th International Conference on Innovations in Information Technology, IIT 2020 . 2020;14:57-62. doi: 10.1109/iit50501.2020.9299050 . · DOI
  109. [129]129. Saa P, Moscoso-Zea O, Costales AC, Lujan-Mora S. Data security issues in cloud-based software-as-a-service ERP. Iberian Conference on Information Systems and Technologies, CISTI . July 2017;12:1-7. doi: 10.23919/cisti.2017.7975779 . · DOI
  110. [130]130. Mayer P, Gerber N, McDermott R, Volkamer M, Vogt J. Productivity vs security: mitigating conflicting goals in organizations. Information and Computer Security . 2017;25(2):137-151. doi: 10.1108/ics-03-2017-0014 . · DOI
  111. [131]131. Ahmed F, Burney A, Malik A. Security aspects of virtualization and its impact on business information security, Institute of Business Management (Iobm), Department of Computer Science, Korangi Creek, Karachi, Pakistan, Institute of Electrical and Electronics Engineers Inc., 2020. doi: 10.1109/icisct49550.2020.9080029 . · DOI
  112. [132]132. Marett K, Barnett T. Information security practices in small-to-medium sized businesses: A hotspot analysis. Information Resources Management Journal . 2019;32(2):18. doi: 10.4018/irmj.2019040104 . · DOI
  113. [133]133. Douchek P, Nedomov´ a L, Luc L, Novak L. Information security: The glory and penury of SMEs in the czech and slovak republics. In Int. Conf. Eng. Manag. Commun. Technol., EMCTECH - Proc , pages 1-7. Institute of Electrical and Electronics Engineers Inc., 2020. doi: 10.1109/emctech49634.2020.9261506 . · DOI
  114. [137]137. van Haastrecht M, Golpur G, Tzismadia G, Kab R, Priboi C, David D, R˘ ac˘ at˘ aian A, Brinkhuis M, Spruit M. A shared cyber threat intelligence solution for SMEs. Electronics (Switzerland) . November 2021;10(23):2913. doi: 10.3390/electronics10232913 . · DOI
  115. [140]140. Rabitti G, Chokami AK, Coyle P, Cohen RD. A taxonomy of cyber risk taxonomies. Risk Analysis . February 2025;45(2):376-386. doi: 10.1111/risa.16629 . · DOI
  116. [144]144. Rhodes C. House of commons library business statistics. House of Commons . 2018;12(1):16. https://commonslibrary. parliament.uk/research-briefings/sn06152/ . March 2025, date last accessed.
  117. [146]146. Bergthaler W, Kang K, Liu Y, Monaghan D. Tackling small and medium sized enterprise problem loans in europe. Technical report, International Monetary Fund, 2015. doi: 10.5089/9781498384834.006 . · DOI
  118. [147]147. Eldridge SM, Chan CL, Campbell MJ, Bond CM, Hopewell S, Thabane L, Lancaster GA, O'Cathain A, Altman D, Bretz F, Cobo E, Craig P, Davidson P, Groves T, Gumedze F, Hewison J, Hirst A, Hoddinott P, Lamb SE, Lang T, McColl E, Shanahan DR, Sutton C, Tugwell P. CONSORT 2010 statement: extension to randomised pilot and feasibility trials. Pilot and Feasibility Studies . 2016;2(1):64. doi: 10.1186/s40814-016-0105-8 . · DOI · Paper page
  119. [148]148. Gill C. Missing links: how descriptive validity impacts the policy relevance of randomized controlled trials in criminology. Journal of Experimental Criminology . September 2011;7(3):201-224. doi: 10.1007/s11292-011-9122-z . · DOI
  120. [149]149. Groß T. Fidelity of statistical reporting in 10 years of cyber security user studies. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) . 2021;11739:3-26. doi: 10.1007/978-3-030-55958-8 1 . · DOI
  121. [150]150. Ali ABA, Ayyasamy RK, Akbar R, Ponnusamy VA, Heng LE. Cybersecurity infrastructure adoption model for malware mitigation in small medium enterprises (SME). In 2022 IEEE 5th International Symposium in Robotics and Manufacturing Automation (ROMA) , pages 1-6, Piscataway, NJ, 2022. IEEE. doi: 10.1109/ROMA55875.2022.9915696 . · DOI
  122. [151]151. Aljumaili T. Exploring the Information Security Policies and Practices Required by Small and Medium-Sized IT Enterprises . PhD thesis, Colorado Technical University, 2018.
  123. [152]152. Babalola AO. Effective Strategies for Cybersecurity and Information Technology Governance for Small Business Leaders: A Quantitative Study . PhD thesis, University of Phoenix, 2021.
  124. [153]153. Borkovich DJ, Skovira RJ. Working from home: Cybersecurity in the age of covid-19. Issues in Information Systems . 2020;21(4): 234-246. doi: 10.48009/4 iis 2020 234-246 . · DOI
  125. [154]154. Brodin M, Rose J. Mobile information security management for small organisation technology upgrades: the policy-driven approach and the evolving implementation approach. International Journal of Mobile Communications . 2020;18(5):598-618. doi: 10.1504/ IJMC.2020.109973 .
  126. [155]155. Ebot A. Technology Acceptance Model for Adopting Cybersecurity Technology in Small and Medium Business/Enterprise: A Generic Qualitative Study . PhD thesis, Capella University, 2024.
  127. [156]156. Eilts D. An empirical assessment of cybersecurity readiness and resilience in small businesses. Issues in Information Systems . 2020;21(3):251-261.
  128. [157]157. Heidenreich M, Franczyk B, Johannsen A. Evaluation study of an IT security measurement method for micro-enterprises. In 2022 International Conference on Electrical, Computer and Energy Technologies (ICECET) , pages 1-7, Piscataway, NJ, 2022. IEEE. doi: 10.1109/ICECET55527.2022.9873487 . · DOI
  129. [158]158. Hoong Y, Rezania D. Navigating cybersecurity governance: The influence of opportunity structures in socio-technical transitions for small and medium enterprises. Computers & Security . 2024;142:103852. doi: 10.1016/j.cose.2024.103852 . · DOI
  130. [159]159. Jr. JHF. Cyber Resilience of Small Business Owners . PhD thesis, Capella University, 2021.
  131. [160]160. Kembumbara V. A Quantitative Study on the Factors Impacting the Adoption of Cybersecurity Frameworks by Small and Medium-Sized Enterprises in the United States . PhD thesis, Capella University, 2024.
  132. [161]161. Lucas ML. Exploring the Strategies Cybersecurity Managers Recommend for Implementing or Transitioning to the Cloud . PhD thesis, Colorado Technical University, 2018.
  133. [162]162. Lynch IM. Department of Defense Controlled Unclassified Information Compliance: The Impact on Small Business Contractors . PhD thesis, Capitol Technology University, 2020.
  134. [163]163. MacEwan N. Responsibilisation, Rules and Rule-following Concerning Cyber Security: Findings from Small Business Case Studies in the UK . PhD thesis, University of Southampton, 2017.
  135. [164]164. Madison JJ. Challenges with Funding of Information Security Projects per Threat Perceptions: A Qualitative Case Study . PhD thesis, Northcentral University, 2016.
  136. [165]165. McLaurin T. A Study on the Efficacy of Small Business Cybersecurity Controls . PhD thesis, Marymount University, 2021.
  137. [166]166. McLilly L. Exploring a Cost-Benefit Cloud-Based On-Demand Cybersecurity Service Solution for Small Businesses: A Quantitative Examination . PhD thesis, Colorado Technical University, 2020.
  138. [167]167. Moneva A, Leukfeldt R. Insider threats among dutch SMEs: Nature and extent of incidents, and cyber security measures. Journal of Criminology . December 2023;56(4):416-440. doi: 10.1177/26338076231161842 . · DOI
  139. [168]168. Muhammad AH, Santoso JD, Akbar AF. Information security investment prioritization using best-worst method for small and medium enterprises. Indonesian Journal of Electrical Engineering and Computer Science . 2023;31(1):271-280. doi: 10.11591/ ijeecs.v31.i1.pp271-280 .
  140. [169]169. Ncubukezi T. Risk likelihood of planned and unplanned cyber-attacks in small business sectors: A cybersecurity concern. In Wilson RL, Curran B, editors, Proceedings of the 18th International Conference on Cyber Warfare and Security (ICCWS 2023) , volume 18, pages 279-290, 2023. doi: 10.34190/iccws.18.1.1084 . · DOI
  141. [170]170. Oluwatimilehin V. Exploring the Strategies Cyber Security Specialists Need to Establish a Church Organization Cloud Computing . PhD thesis, Colorado Technical University, 2019.
  142. [171]171. Orellana FD. Cybersecurity Incident Response Capabilities in the Ecuadorian Small Business Sector: A Qualitative Study . PhD thesis, Northcentral University, 2020.
  143. [172]172. Ozkan BY, Spruit M. Addressing SME characteristics for designing information security maturity models. In Human Aspects of Information Security and Assurance (HAISA 2020), IFIP Advances in Information and Communication Technology , volume 593. Springer, 2020. doi: 10.1007/978-3-030-57404-8 13 . · DOI
  144. [173]173. Ozkan BY, Spruit M. Adaptable security maturity assessment and standardization for digital SMEs. Journal of Computer Information Systems . 2023;63(4):965-987. doi: 10.1080/08874417.2022.2119442 . · DOI
  145. [174]174. Pringle Q. The Strategies IT Professionals Need to Improve Employee Security Behavior Affecting the Organization's Security Risks . PhD thesis, Colorado Technical University, 2020.
  146. [175]175. Shah A. Determination of ISRA framework using Delphi methodology for small and midsized enterprises . PhD thesis, Capella University, 2017.
  147. [176]176. Simon T, Venard B. Technical codes' potentialities in cybersecurity. a contextual approach on the ethics of small digital organizations in france. In 2020 International Conference on Cyber Security and Protection of Digital Services, Cyber Security 2020 , pages 1-8, Piscataway, NJ, 2020. Institute of Electrical and Electronics Engineers Inc. doi: 10.1109/CyberSecurity49315. 2020.9138895 . · DOI
  148. [177]177. Tsimba G. Exploring the Strategic Management Principles to Improve Information Security Governance in Small and Medium-Sized Business . PhD thesis, Colorado Technical University, 2021.

Cited by

Sorted by citations

Metadata

Authors
Junior, C. R., Becker, I., & Johnson, S.
Affiliations
University College London (GB)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2023
Volume
12
Issue
1
ISSN
2057-2085 (ISSN-L)
DOI
10.48550/arxiv.2309.17186
arXiv
2309.17186
OpenAlex
W4387294207
Cited by
8
References
2
Citations by year
2026: 2 · 2025: 5 · 2024: 1
FWCI
3.57
Type
journal article
Language
en
Open access
Licence
Locations
  • Journal of Cybersecurity (publishedVersion, cc-by-nc)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Social Sciences › Law › Cybercrime and Law Enforcement Studies
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
Keywords
small and medium-sized enterprises, cyber resilience, cybersecurity literacy, cyber threats, cybersecurity controls, resource availability, developing countries

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review