Investigating Potential Barriers to Cybersecurity Risk Management Investment in SMEs
Abdulmajeed Abdullah Alahmari, Bob Duncan · 2021
Ignoring the importance of cybersecurity risk management in SMEs became an issue among decision-makers. Lack of strategic investment decision by SMEs could lead to further risks and vulnerabilities. The significant increase of cybersecurity threats might become a very difficult task for both SMEs and other parties in the future. The purpose of this paper is to identify potential barriers to cybersecurity risk management investment in SMEs based on conducting several interviews with decision-makers in the sector to understand the causes of this prevention. The authors aim to reveal the role the SMEs’ decision-makers are playing in addressing cybersecurity risks in recent years and to suggest avenues for further research. The paper follows a qualitative exploratory approach to identify those potential barriers. Starting with an invitation are distributed by e-mail, phone call, or social medial account, to hundreds of Saudi’s decision-makers in the SMEs sector, asking them to participate in this study. As a result, 20 participants from various SMEs business sectors have agreed to participate. Therefore, six potential barriers that play a key role in the prevention of cybersecurity risk management investment in SMEs, which are the financial capacity, the lack of awareness, the size of SMEs, the traditional commerce, the absence of risk standards, and the over-confidence of decision-makers. Some of these barriers impacts have been discussed before in different contexts. Yet, this study investigates these barriers impact on preventing SMEs from investing in CRM. Also, to the best of authors knowledge, none of previous research has combined these barriers together with an insight to measure their effect on managerial decision-making. Further research on cybersecurity risk management in SMEs is needed.