Cybersecurity Awareness for Small and Medium-Sized Enterprises (SMEs): Availability and Scope of Free and Inexpensive Awareness Resources

Abstract

Small and medium-sized enterprises (SMEs) are considered the backbone of Europe’s economy. However, SMEs are often bounded by resource constraints that also limit their cybersecurity posture. In such circumstances, SMEs could potentially benefit from the free and inexpensive cybersecurity awareness (CSA) resources produced and distributed by various public and private entities. SMEs can utilize these affordable resources to elevate the knowledge and skills of employees and transform their cybersecurity attitudes and behavior. The security-conscious employees can serve as the organization’s first line of defense against cyber-attacks and -crimes. However, prior to employing such awareness resources, it would require answering the question “how abundance and well-suited are the (affordable) awareness resources for SMEs?” To address this concern, we used an exploratory approach and examined the awareness resources from 71 sources chosen after the review of 938 potential sources. Since the primary audience of the study was European SMEs, most of the sources analyzed come from European organizations. Based on our findings, while these affordable awareness resources could benefit SMEs, they do require some adjustment to better meet the requirements and situations of SMEs. Furthermore, the awareness resources exclusively targeting SMEs and the diverse business areas SMEs serve, are insufficient. As a result, all involved entities, at the national and European levels, are encouraged to produce and distribute more localized awareness resources that are affordable and best match the demands and business areas of SMEs. Finally, the awareness resources should also include appropriate features for interested users to submit their feedback.