Design and evaluation of a self-paced cybersecurity tool

Abstract

Purpose This paper aims to present the evaluation of a self-paced tool, CyberSecurity Coach (CYSEC), and discuss the adoption of CYSEC for cybersecurity capability improvement in small- and medium-sized enterprises (SMEs). Cybersecurity is increasingly a concern for SMEs. Previous literature has explored the role of tools for awareness raising. However, few studies validated the effectiveness and usefulness of cybersecurity tools for SMEs in real-world practices. Design/methodology/approach This study is built on a qualitative approach to investigating how CYSEC is used in SMEs to support awareness raising and capability improvement. CYSEC was placed in operation in 12 SMEs. This study first conducted a survey study and then nine structured interviews with chief executive officers (CEOs) and chief information security officers (CISO). Findings The results emphasise that SMEs are heterogeneous. Thus, one cybersecurity solution may not suit all SMEs. The findings specify that the tool’s adoption varied quite widely. Four factors are primary determinants influencing the adoption of CYSEC: personalisation features, CEOs’ or CISOs’ awareness level, CEOs’ or CISOs’ cybersecurity and IT knowledge and skill and connection to cybersecurity expertise. Originality/value This empirical study provides new insights into how a self-paced tool has been used in SMEs. This study advances the understanding of cybersecurity activities in SMEs by studying the adoption of CYSEC. Moreover, this study proposes significant dimensions for future research.

Digital transformation in SMEs: Identifying cybersecurity risks and developing effective mitigation strategies

“…Factors such as personalization features of the tool, the awareness level of chief executive officers (CEOs) or chief information security officers (CISOs), and their cybersecurity and IT knowledge significantly influenced the adoption and effectiveness of CYSEC. This study underscores the necessity for cybersecurity solutions to be adaptable and tailored to the specific needs and capabilities of each SME, highlighting that a one-size-fits-all approach is insufficient in addressing the diverse cybersecurity challenges faced by SMEs (Shojaifar & Fricker, 2023). Evre and Ciylan (2023) propose a novel approach to evaluating cybersecurity strategy effectiveness through a scorecard based on risk analysis.…”

“…In the rapidly evolving digital landscape, small and medium-sized enterprises (SMEs) are increasingly recognizing the critical importance of robust cybersecurity strategies to safeguard their assets and maintain business continuity. Shojaifar and Fricker (2023) explore the adoption of CyberSecurity Coach (CYSEC), a self-paced tool designed to enhance cybersecurity capabilities within SMEs. Their study, conducted across 12 SMEs, reveals the heterogeneity of SMEs in terms of cybersecurity needs and the varying success of tool adoption.…”

Accelerating SME growth in the African context: Harnessing FinTech, AI, and cybersecurity for economic prosperity

“…SMEs in Africa face challenges in complying with cybersecurity regulations due to limited resources and awareness. This is exacerbated by the lack of adoption of cybersecurity solutions, which poses a real risk (Kabanda et al, 2018;Shojaifar & Fricker, 2023). The challenges of budget constraints and the inability to afford cybersecurity systems hinder SMEs from establishing robust technological infrastructure.…”