Leveraging User Centred Design (UCD) to improve Small Medium Sized Enterprise (SME) cybersecurity engagement

Abstract

Over a decade of research has focused on improving the cybersecurity of Small and Medium-Sized Enterprises (SMEs), yet adoption of protective measures, such as the UK’s Cyber Essentials scheme, remains low, leaving these businesses vulnerable to significant risks. This thesis adopts a new approach in the SME domain, diverging from previous studies that primarily focused on gathering data from SMEs and SME cybersecurity consultants (providers) to address adoption barriers. Instead, it emphasises enhancing providers' understanding of SME cybersecurity needs and improving their engagement with SMEs by leveraging User Centred Design (UCD) principles. Improving providers’ ability to engage effectively with SMEs offers a promising path to increasing the adoption of protective measures which can prevent cyber-attacks. Drawing on UCD principles this thesis collected data through a survey targeting SMEs and interviews with micro and small businesses, as well as providers. The survey revealed varying self-efficacy levels among SMEs in implementing recommendations from the National Cyber Security Centre’s (NCSC) Small Business Guide. Interviews with providers highlighted that SMEs often underestimate risks from un-targeted, automated attacks, and micro business interviews suggested this misunderstanding was rooted in a limited understanding of how cybercriminals operate and select targets. Using the interview data, this thesis developed three UCD inspired micro business cybersecurity artefacts: an Empathy Map (visualises user thoughts, feelings behaviours), a set of Cybersecurity User Needs (highlights specific security requirements of users), and Mindsets (profiles user beliefs and approaches to cybersecurity). These artefacts are designed to help providers enhance their understanding of micro and small businesses and improve their engagement with them. The Mindset artefacts were evaluated through a survey with SME cybersecurity providers, who reported their high potential to improve understanding and facilitate more effective engagements.

Date of Award	18 Jun 2025
Original language	English
Awarding Institution	Abertay University
Sponsors	North East Business Resilience Centre
Supervisor	Alastair Irons (Supervisor), Sharon McDonald (Supervisor) & Jacques Ophoff (Supervisor)