Enhancing Cybersecurity Awareness in Small and Medium Enterprises Through a User-Friendly Risk Assessment Tool
Miriam Curtin, Brian Sheehan, Melanie Gruben, Gillian O’Carroll, Hazel Murray · 2025
Small and medium enterprises (SMEs) are the backbone of the global economy and are increasingly vulnerable to cyber threats due to constrained resources and limited cybersecurity expertise. Despite the availability of international cybersecurity guidance, SMEs struggle to identify and mitigate their cyber risks effectively. This study addresses this gap by developing an accessible, SME-focused cyber risk assessment tool that simplifies cybersecurity for non-experts. Through a comprehensive review of existing risk assessment frameworks and iterative collaboration with SMEs, we designed a user-friendly tool. Piloted with Irish SMEs, the tool provided valuable insights into the current cybersecurity landscape, revealing critical vulnerabilities in areas such as data protection, where 67% of participants said they did not test their backups, and incident preparedness, where 83% of participants said they would not know what to do if a cyber incident occurred. Our tool not only evaluates cyber risk but also enhances SME awareness by guiding them through key cybersecurity considerations. This study demonstrates that an intuitive risk assessment tool can empower SMEs to strengthen their cyber resilience, ensuring more businesses can proactively protect themselves against evolving threats.