Martin Wilson

In this chapter, we explore small and medium-sized enterprises’ (SMEs’) attitudes to cybersecurity adoption in the United Kingdom through a survey of 85 small businesses. The results suggest that misconceptions frequently affect business owners’ decisions when engaging with cybersecurity about the level of risk to their business, the nature of cyberattacks, and a general lack of understanding about cybersecurity practices and technologies. We consider these data in light of how we might best inform SME cybersecurity decision makers and assist those who engage with SMEs to improve cybersecurity.

We report an online survey of 85 U.K-based SMEs that explored their threat and coping appraisals toward five common types of cyber-attack: Network being hacked; Data being stolen or encrypted; malware infection; mobile devices being compromised; and phishing e-mail attack. Overall, SMEs’ reported assessment of the risk of an attack was low, particularly for the possibility of their business network being hacked or their data being stolen or encrypted. However, there was an incongruence in their Threat Appraisals since, while they believed the risks to be low, they reported that the impact would be high. In terms of Coping Appraisal, respondents indicated that measures to prevent such attacks were both inexpensive and effective. However, their reported self-efficacy was significantly lower for keeping mobile devices safe and avoiding phishing attacks. We discuss these results taking into consideration additional qualitative data and provide recommendations for SME engagement.