Vaccination Model: self-protective behavior in the face of Ransomware Attack in SMEs

Abstract

In today's business environment, the reliance of business processes on information technology (IT) has never been stronger, making the maintenance and security of IT systems crucial for organizations. Ransomware attacks present a significant cybersecurity risk, yet many existing solutions primarily focus on technology, overlooking the critical role of human behavior in system security. To address this gap, we experimented to assess the impact of controlled exposure to ransomware attacks on users' protection motivation and behavior. Unlike traditional security training, our approach actively engaged users in real-life scenarios and hands-on security events. The results demonstrated that controlled exposure to ransomware significantly heightened users' vigilance and improved their ability to recognize and respond to phishing campaigns. These findings indicate that hands-on exposure experiences enhance learning and boost protection motivation, sustaining positive effects on cybersecurity behavior. Our study underscores the importance of addressing the human factor in cybersecurity and introduces a promising approach to fortifying resilience against cyber threats. The vaccination model exemplifies a practical and effective strategy for improving cybersecurity readiness within authentic organizational environments by shaping users' mindsets and actions through real threat demonstrations.