Strengthening Cybersecurity in Small and Medium-Sized Enterprises: Balancing Technology, Costs, Compliance, and Employee Awareness
Weiyang Ye · SAGE Open · 2026
Micro, small, and medium-sized enterprises (MSMEs) shoulder a disproportionate share of cyber risk yet remains underrepresented in empirical cybersecurity research. This study develops and validates an integrated Technology–Organization–Environment (TOE) and Resource-Based View (RBV) framework to explain cybersecurity management effectiveness and its performance payoffs in MSMEs. Using a sequential explanatory mixed-methods design, we analyze survey data from 847 MSMEs across sectors and regions, complemented by 32 expert interviews. Psychometrically validated measures feed a structural equation model (SEM) and a fuzzy-set qualitative comparative analysis (fsQCA). SEM results show cybersecurity awareness is the strongest predictor of management effectiveness (β = .486, p < .001), followed by technology readiness (β = .412, p < .001); economic constraints exert an adverse effect (β = −.297, p < .001), while regulatory compliance contributes positively (β = .234, p < .001). Effectiveness, in turn, predicts organizational performance (β = .573, p < .001), with R 2 values of .671 for effectiveness and .328 for performance. Mediation tests indicate that effectiveness fully mediates the impacts of awareness, technology readiness, and compliance, and partially mediates the impact of economic constraints, highlighting cybersecurity as a dynamic capability that converts resources into outcomes. fsQCA reveals four equifinal pathways to high effectiveness (technology-driven, awareness-intensive, compliance-driven, and resource-optimized), offering actionable strategies for heterogeneous and resource-limited firms. The findings advance theory by quantifying human-capital and capability mechanisms often overshadowed by technology-centric narratives, and they inform practice and policy by prioritizing awareness programs, targeted technology adoption, proportionate compliance scaffolds, and resource-sensitive investment portfolios.