Analysing the cyber security support journeys of small and medium sized organisations

Small and medium-sized enterprises (SMEs) frequently find themselves as exposed to cyber security threats as larger organisations. However, most SMEs are not experts in cyber security and therefore need additional support to enhance their cyber resilience. Furthermore, although they may seek related support, there is minimal knowledge about how they approach this or how effective the support is. This study aimed to understand the support journeys that SMEs pursue when they have a question or concern about cyber security, sampling both SMEs and cyber security providers. Both groups were asked to record each time they had a support journey instance, to outline factors such as what the instance involved, how satisfied they were with the support, and what the resulting outcomes were. This enabled comparison of how support was accessed, experienced, and resolved across cases, from the initial trigger for support through to the outcome. A series of practical recommendations are provided within this paper following the analysis of these support journeys, to consider how both SMEs and providers can benefit from the support journey experience. The experiences also highlight some of the broader challenges of supporting SME engagement with cyber security, including the constraints they face in terms of time and understanding.