Mind the Gap: Revealing Security Barriers through Situational Awareness of Small and Medium Business Key Decision-Makers
Yuanhaur Chang, Oren Heller, Yaniv Shlomo, Iddo Bar-Noy, Ella Bokobza, Michal Grinstein-Weiss, Ning Zhang

TL;DR
This study investigates cybersecurity decision-making in SMBs, revealing awareness gaps and proposing interventions to enhance security practices through a mixed-method approach and situational awareness modeling.
Contribution
It introduces a comprehensive analysis of SMB decision-makers' cybersecurity awareness and develops a model to improve their security decision-making.
Findings
SMB decision-makers have varying levels of cybersecurity awareness.
Perceived risks influence defense measure choices.
Interventions can enhance SMB cybersecurity awareness.
Abstract
Key decision-makers in small and medium businesses (SMBs) often lack the awareness and knowledge to implement cybersecurity measures effectively. To gain a deeper understanding of how SMB executives navigate cybersecurity decision-making, we deployed a mixed-method approach, conducting semi-structured interviews (n=21) and online surveys (n=322) with SMB key decision-makers. Using thematic analysis, we revealed SMB decision-makers' perceived risks in terms of the digital assets they valued, and found reasons for their choice of defense measures and factors impacting security perception. We employed the situational awareness model to characterize decision-makers based on cybersecurity awareness, identifying those who have comparatively low awareness in the fight against adversaries. We further explored the relationship between awareness and business attributes, and constructed a holistic…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsInformation and Cyber Security · Supply Chain Resilience and Risk Management · Cybersecurity and Cyber Warfare Studies
