Leveraging User Centred Design (UCD) to improve Small Medium Sized Enterprise (SME) cybersecurity engagement

Over a decade of research has focused on improving the cybersecurity of Small and Medium-Sized Enterprises (SMEs), yet adoption of protective measures, such as the UK’s Cyber Essentials scheme, remains low, leaving these businesses vulnerable to significant risks. This thesis adopts a new approach in the SME domain, diverging from previous studies that primarily focused on gathering data from SMEs and SME cybersecurity consultants (providers) to address adoption barriers. Instead, it emphasises enhancing providers' understanding of SME cybersecurity needs and improving their engagement with SMEs by leveraging User Centred Design (UCD) principles. Improving providers’ ability to engage effectively with SMEs offers a promising path to increasing the adoption of protective measures which can prevent cyber-attacks. Drawing on UCD principles this thesis collected data through a survey targeting SMEs and interviews with micro and small businesses, as well as providers. The survey revealed varying self-efficacy levels among SMEs in implementing recommendations from the National Cyber Security Centre’s (NCSC) Small Business Guide. Interviews with providers highlighted that SMEs often underestimate risks from un-targeted, automated attacks, and micro business interviews suggested this misunderstanding was rooted in a limited understanding of how cybercriminals operate and select targets. Using the interview data, this thesis developed three UCD inspired micro business cybersecurity artefacts: an Empathy Map (visualises user thoughts, feelings behaviours), a set of Cybersecurity User Needs (highlights specific security requirements of users), and Mindsets (profiles user beliefs and approaches to cybersecurity). These artefacts are designed to help providers enhance their understanding of micro and small businesses and improve their engagement with them. The Mindset artefacts were evaluated through a survey with SME cybersecurity providers, who reported their high potential to improve understanding and facilitate more effective engagements.

Name dc:type.qualificationname

PhD

Level dc:type.qualificationlevel

Doctoral Thesis

Grantor dc:publisher.institution

Abertay University

Year dc:date.issued

2025

Author dc:creator

• Wilson, Martin

Advisors dc:contributor.advisor

• Irons, Alastair
• Ophoff, Jacobus

• SME cybersecurity
• User Centred Design (UCD)
• Cybersecurity providers
• Empathy maps
• User needs
• Mindsets

Language dc:language

eng

Identifier

oai:rke.abertay.ac.uk:studenttheses/134f5a6d-5de7-4313-9cb3-90aa13bfa202

OAI identifier oai:identifier

oai:rke.abertay.ac.uk:studenttheses/134f5a6d-5de7-4313-9cb3-90aa13bfa202