Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity

arXiv:2309.17186 · cs.CR · Submitted 2023-09-29 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: Today's paper: "Unaware, Unfunded and Uneducated".

Elias: As a fastidious and diligent AI researcher, I have meticulously analyzed both provided texts to synthesize a comprehensive summary of the paper "Unaware, Unfunded and Uneducated:

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: This paper, "Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity," looked at the existing literature between two thousand seventeen and two thousand twenty-four to see what research actually exists on cyber threats, adopted controls, challenges, and constraints SMEs face when trying to be resilient.

Priya: So if you're listening for a moment, what this means is that we probably need to stop looking at just technical solutions and start focusing on education and basic risk awareness for these smaller companies.

Elias: The core finding of this paper is that the research in this area is really underdeveloped; there isn't much progress on what these businesses actually face in terms of threats and how they try to defend themselves >

Nadia: Exactly, they found that the research has made little progress in understanding SMEs' roles, threats, and needs. The review narrowed down one thousand ninety studies to one hundred thirty-two relevant papers and found forty-four unique themes >

Elias: They identified four main challenges SMEs face in getting cyber resilience, which are a lack of awareness of threats, limited cybersecurity literacy, constrained financial resources, and variable resource availability depending on whether the country was developed or developing >

Conclusion: Nadia: So we're wrapping up this look at "Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity," which examined over a thousand studies from two thousand seventeen to two thousand twenty-four about small and medium enterprises.

Elias: The core takeaway is that the research in this area is really underdeveloped; there isn't much progress on what these businesses actually face in terms of threats and how they try to defend themselves >

Priya: They linked a few different things together, suggesting the main hurdle for SMEs isn't just the hackers or the technical stuff we usually focus on.

Nadia: Exactly. They pointed out three core challenges: a lack of knowing what risks they have, not having enough money or resources to fix them, and people just not having enough cybersecurity training >

Elias: And they made a specific claim about how these factors interact, saying that the lack of literacy seems to be the root cause driving both the low awareness and the resource struggles >

Priya: So if you're listening for a moment, what this means is we probably need to stop looking at just technical solutions and start focusing on education and basic risk awareness for these smaller companies.

Nadia: Right. The title itself, "Unaware, Unfunded and Uneducated," really sums up that reality for the business world right now >

Elias: And the authors' conclusion suggests that future research needs to look at how these three issues feed into each other so we can actually build targeted help for SMEs instead of just throwing general security tools at them >

Priya: That makes sense. It shifts the focus from just patching vulnerabilities to fixing the fundamental knowledge and resource gaps first >

Nadia: So, it's less about finding one perfect defense mechanism and more about building a foundation of awareness and competence across the entire SME ecosystem >

University College of London

cs.CR

Submitted: 2023-09-29

Updated: 2026-10-15

Comments: This article has been accepted for publication in Journal of Cyber Security, published by Oxford University Press. Available at: https://doi.org/10.1093/cybsec/tyag030

Journal ref: Journal of Cybersecurity, Volume 12, Issue 1, 2026, tyag030

DOI: 10.1093/cybsec/tyag030

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 91/100

The gist: As a fastidious and diligent AI researcher, I have meticulously analyzed both provided texts to synthesize a comprehensive summary of the paper "Unaware, Unfunded and Uneducated: A Systematic Review

Key concepts

Cybersecurity Resilience: This refers to an SME's ability to withstand and recover from cyberattacks. It involves having the right controls, knowledge, and resources in place so that when a threat occurs, the business can minimize damage and quickly return to normal operations.
Cybersecurity Literacy: This is the level of knowledge and training that SME employees have regarding cybersecurity risks. Low literacy means staff may not recognize threats or know how to follow security protocols, making them vulnerable to incidents.
Resource Constraints: SMEs often struggle with limited financial, human, and digital resources when trying to implement security measures. This lack of funding and personnel makes it difficult for them to adopt necessary controls and maintain a strong defense against cyber threats.

Terminology

Papers — 1× in this paper · explained in 3 episodes

Summary

As a fastidious and diligent AI researcher, I have meticulously analyzed both provided texts to synthesize a comprehensive summary of the paper Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity.

Here is the detailed synthesis:

Comprehensive Summary of Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity

This systematic review synthesized existing cybersecurity literature concerning Small and Medium Enterprises (SMEs), focusing on cyber threats, adopted controls, inherent challenges, and constraints that SMEs encounter when attempting to build cybersecurity resilience. The review was conducted by analyzing 1090 studies published between 2017 and 2024, which were subsequently narrowed down to 132 relevant papers for in-depth analysis.

Key Findings and Research Gaps:

The primary finding of the synthesis is that existing research on SMEs in cybersecurity remains shallow, indicating a significant lack of progress in understanding the specific roles, threats, and nuanced needs of this critical business segment. A central theme emerging from the literature is that limited cybersecurity literacy appears to be a root cause, driving both a lack of awareness regarding cyber risks and contributing to resource constraints.

Identified Challenges and Hindrances:

The analysis pinpointed three significant barriers impeding SMEs' ability to achieve robust cybersecurity resilience:

Lack of Awareness of Cybersecurity Risks: SMEs frequently suffer from insufficient understanding of the specific threats they face in the digital landscape.
Underfunded and Resource-Constrained Programs: A pervasive issue is the scarcity of financial, human, and digital resources necessary to implement adequate cybersecurity programs.
Limited Cybersecurity Literacy: The personnel within SMEs often possess insufficient knowledge or training to effectively manage security protocols and respond to incidents.

Furthermore, the research highlighted a crucial causal relationship: limited literacy acts as a main deterrent, influencing both the awareness of risks and the ability to secure resources effectively. Resource availability was noted as being highly variable depending on whether the SME was located in a developed or developing country.

Significant Thematic Discussion Points:

The discussion section elaborated on several interconnected themes that underscore the difficulties SMEs face:

Lack of Awareness: This extends beyond technical threats to include a low perception of overall cybersecurity risks.
Leadership Deficiencies: There is often an overwhelming, sparse, or non-existent presence of dedicated cybersecurity leadership within SME structures.
Operational Weaknesses: Poor security operations are frequently cited as another major hurdle.

The review also addressed the specific research questions posed to guide the study: What threats do SMEs face? What level of awareness do they possess? How are cybersecurity controls being adopted? Which existing frameworks are applicable or need tailoring for SMEs? And what challenges exist in adhering to these frameworks? The discussion confirmed that a lack of tailored solutions and frameworks, coupled with low perception of risk, significantly hinders progress.

Conclusion and Future Research Directions:

The systematic review concluded that the three most significant barriers to SME cybersecurity are: a lack of awareness of threats faced, resource constraints (human, digital, and financial), and limited cybersecurity literacy among SME personnel. The authors strongly recommend that future research must move beyond simply identifying these barriers to investigate the mechanisms through which these factors interact and affect one another. This understanding is vital for enabling governments and industry stakeholders to develop targeted initiatives specifically designed to meet the unique needs of SMEs.

Methodological Caveats:

The review noted variability in reporting standards across the 132 analyzed studies, leading the researchers to question the overall reliability of some literature within the field.

Improvements for AI systems

The AI system can develop tailored cybersecurity frameworks by synthesizing existing research on SME needs, as noted by C. Ponsard’s conclusion: Unfortunately, standards and frameworks were designed in the first place with large companies in mind and are not tailored to the needs and resources of SMEs.
The system can provide risk assessment guidance based on identified themes, specifically addressing the gap where no research has been found to enumerate these threats by proposing a SME-focused taxonomy of threats.
The AI can optimize resource allocation recommendations by understanding the vicious circle where decision-makers with little to no literacy in cybersecurity invest less in cybersecurity, consequently limiting their access to skilled talent.
The system can improve control efficiency by suggesting specific actions against identified poor operations, such as addressing the uncontrolled deployment of open-source software and unmanaged anti-virus software which were highlighted as inefficient controls.
The AI can enhance employee engagement strategies by linking awareness to behavior, leveraging the finding that increasing cybersecurity awareness amongst employees increases the likelihood of the (self-reported) adoption of appropriate security behaviours.

Abstract

Small and medium enterprises (SMEs) are pivotal in the global economy, accounting for over 90% of businesses and 60% of employment worldwide. Despite their significance, SMEs are often disregarded in cybersecurity initiatives, rendering them ill-equipped to deal with the growing frequency, sophistication, and destructiveness of cyberattacks. We systematically reviewed the cybersecurity literature on SMEs published between 2017 and 2024. We focused on research discussing cyber threats, adopted controls, challenges, and constraints SMEs face in pursuing cybersecurity resilience. Our search yielded 1090 studies that we narrowed to 132 relevant papers. We identified 44 unique themes and categorised them as novel findings or established knowledge. This distinction revealed that research on SMEs is underdeveloped and has made little progress in understanding SMEs' roles, threats, and needs. Studies often repeated early discoveries without replicating or offering new insights. Existing research indicates that the main challenges to attaining cybersecurity resilience of SMEs are a lack of awareness of cybersecurity risks, limited cybersecurity literacy, and constrained financial resources. Resource availability varied between developed and developing countries. Our analysis indicated a relationship among these themes, suggesting that limited literacy is the root cause of awareness and resource constraint issues.