TY - JOUR
T1 - What micro-businesses need
T2 - a user-centered approach to cybersecurity support
AU - Wilson, Martin
AU - McDonald, Sharon
AU - Irons, Alastair
AU - Cockcroft, Joe
N1 - © 2026 The Author(s). Published by Informa UK Limited, trading as Taylor & Francis Group
This is an Open Access article distributed under the terms of the Creative Commons Attribution-NonCommercial-NoDerivatives License (http://creativecommons.org/licenses/by-nc-nd/4.0/), which permits non-commercial re-use, distribution, and reproduction in any medium, provided the original work is properly cited, and is not altered, transformed, or built upon in any way. The terms on which this article has been published allow the posting of the Accepted Manuscript in a repository by the author(s) or with their consent.
Data availability statement:
The participants of this study did not give written consent for their data to be shared publicly, so due to the sensitive nature of the research, supporting data is not available.
PY - 2026/6/21
Y1 - 2026/6/21
N2 - Micro-businesses are disproportionately exposed to cyber threats yet remain underserved by generic ‘one size fits all’ cybersecurity guidance that often fails to reflect their resource constraints and operational realities. To address this research-practice gap, this study adopts a user-centered design (UCD) approach to synthesise and articulate the cybersecurity needs of UK micro-businesses. Thirty semi-structured interviews were conducted across three subgroups: Digitally Dependent, Digitally Based, and Digital Enablers. Thematic analysis generated 36 user needs, expressed using the UK Government Digital Service (GDS) format and organised into four categories: Guidance, Posture, Resources, and Return on Investment (ROI). Guidance needs were most prominent, highlighting demand for actionable, simple, tailored, and trustworthy support that reaches businesses proactively, avoiding fear appeals. While resource constraints were universal, subgroup differences emerged particularly in ROI and regulatory awareness, underscoring the limitations of homogeneous SME engagement strategies. Rather than offering new findings on barriers to adoption or proposing empirically validated interventions, the study contributes a structured, user-needs-led benchmark and a literature-informed ‘opportunity space’ for designing more contextually aligned cybersecurity support. Overall, the findings suggest that improving SME cybersecurity engagement may depend less on generating new knowledge and more on translating existing insights into accessible, actionable, and user-aligned forms of support.
AB - Micro-businesses are disproportionately exposed to cyber threats yet remain underserved by generic ‘one size fits all’ cybersecurity guidance that often fails to reflect their resource constraints and operational realities. To address this research-practice gap, this study adopts a user-centered design (UCD) approach to synthesise and articulate the cybersecurity needs of UK micro-businesses. Thirty semi-structured interviews were conducted across three subgroups: Digitally Dependent, Digitally Based, and Digital Enablers. Thematic analysis generated 36 user needs, expressed using the UK Government Digital Service (GDS) format and organised into four categories: Guidance, Posture, Resources, and Return on Investment (ROI). Guidance needs were most prominent, highlighting demand for actionable, simple, tailored, and trustworthy support that reaches businesses proactively, avoiding fear appeals. While resource constraints were universal, subgroup differences emerged particularly in ROI and regulatory awareness, underscoring the limitations of homogeneous SME engagement strategies. Rather than offering new findings on barriers to adoption or proposing empirically validated interventions, the study contributes a structured, user-needs-led benchmark and a literature-informed ‘opportunity space’ for designing more contextually aligned cybersecurity support. Overall, the findings suggest that improving SME cybersecurity engagement may depend less on generating new knowledge and more on translating existing insights into accessible, actionable, and user-aligned forms of support.
U2 - 10.1080/0144929X.2026.2686166
DO - 10.1080/0144929X.2026.2686166
M3 - Article
SN - 0144-929X
JO - Behaviour and Information Technology
JF - Behaviour and Information Technology
ER -