Abstract This study examines the relationship between cybersecurity and the digitalization of small and medium-sized enterprises (SMEs). Digitalization is conceptualized as a gradual, path-dependent process in which firms adopt digital technologies over time, increasing both connectivity and exposure to cyber threats. Drawing on protection motivation theory (PMT), we interpret digitalization as a form of motivated protective behavior shaped by two cognitive mechanisms: threat appraisal and coping appraisal. To investigate this relationship, we conducted a survey of 239 UK-based SMEs in 2022 and analyzed the data using regression models and artificial neural networks (ANN). The findings show that cybersecurity practices are significantly and positively associated with digitalization, but their association varies depending on SMEs’ digital maturity. At early stages, digitalization is driven primarily by perceived cyber risk, whereas at more advanced stages, established cybersecurity routines and standards act as enablers of further digital adoption. This study contributes to the literature by extending PMT to the organizational level and demonstrating that cybersecurity is not merely a constraint or protective add-on, but a central mechanism shaping digital transformation in SMEs.
Abstract Small and medium enterprises (SMEs) are pivotal in the global economy, accounting for over 90% of businesses and 60% of employment worldwide. Despite their significance, SMEs are often disregarded in cybersecurity initiatives, rendering them ill-equipped to deal with the growing frequency, sophistication, and destructiveness of cyberattacks. We systematically reviewed the cybersecurity literature on SMEs published between 2017 and 2024. We focused on research discussing cyber threats, adopted controls, challenges, and constraints SMEs face in pursuing cybersecurity resilience. Our search yielded 1090 studies that we narrowed to 132 relevant papers. We identified 44 unique themes and categorized them as novel findings or established knowledge. This distinction revealed that research on SMEs is underdeveloped and has made little progress in understanding SMEs’ roles, threats, and needs. Studies often repeated early discoveries without replicating or offering new insights. Existing research indicates that the main challenges to attaining cybersecurity resilience of SMEs are a lack of awareness of cybersecurity risks, limited cybersecurity literacy, and constrained financial resources. Resource availability varied between developed and developing countries. Our analysis indicated a relationship among these themes, suggesting that limited literacy is the root cause of awareness and resource constraint issues.
Abstract The aim of this article is to identify the financial determinants of cyberattacks on banks, using a global sample of 319 publicly disclosed cyberattacks that occurred in 53 countries between 2014 and 2024. Drawing on data on bank-level financial ratios, we find that the size of a bank (its total assets and deposit base), are positively associated with the likelihood of experiencing a cyberattack. Doubling the bank’s assets raises the probability of a cyberattack by around 3.8 percentage points. The results are robust across various model specifications, estimation methods, and samples. Nevertheless, in the USA, smaller, less resilient, and less efficient banks are more likely to experience observed cyber incidents. Overall, the findings have actionable policy implications for both banks and prudential supervisors.
Abstract Implementing cybersecurity controls in real-world environments can be complex due to the presence of legacy systems and fragmented infrastructure that were not originally designed with security in mind. To address these challenges, many cybersecurity leaders turn to peer-reviewed frameworks and standards as strategic tools to structure, assess, and mature their organization’s security posture. These frameworks offer a common language and baseline for measuring progress, ensuring compliance, and aligning with industry best practices. However, when the adoption of such frameworks is not mandated by regulation or external partnerships, organizational acceptance can become inconsistent or reluctant. This study applies the Unified Theory of Acceptance and Use of Technology 2 (UTAUT2) to examine Behavioral Intention (BI) toward continued framework use among US-based cybersecurity leaders (N = 53). Using multiple regression analysis, the seven UTAUT2 constructs were evaluated as predictors of BI. The full model explained ~50% of the variance in intention (R² = 0.499, P < .001). Habit emerged as the only statistically significant predictor (β = 0.360, P = .005), suggesting that established patterns of framework use may play a dominant role in sustained adoption within this population. Exploratory post hoc item-level analyses indicated that refinement of select construct measures modestly improved internal consistency and slightly increased overall model fit. These findings suggest that leadership adoption of cybersecurity frameworks may be influenced more by institutionalized usage patterns than by traditional utility-based predictors and that adaptation of technology acceptance instruments may improve their applicability in cybersecurity governance contexts.
Abstract This article explores the formation of a quasi-export control regime led by private technology and cybersecurity firms, aimed at curbing the proliferation of offensive cyber capabilities. While traditional export control regimes are state-driven and legally binding, this emergent framework is enforced through informal, decentralized mechanisms grounded in industry norms—particularly those articulated by the Cybersecurity Tech Accord (CTA). The article argues that prominent technology companies have evolved from norm entrepreneurs to de facto regulators by deploying enforcement tools that include public attribution reports, denial of digital services, strategic litigation, and collaboration with civil society. By analyzing key enforcement actions and the normative logic behind them, the article shows how this private regime replicates core features of formal export control—target identification, norm articulation, and sanctioning. This article also demonstrates how alignment with human rights principles shapes the application of sanctions in this regime. The asymmetrical treatment of similar firms underscores the conditional nature of market legitimacy in the digital ecosystem. Situated within broader literature on norm entrepreneurship and private authority, the article contends that this regime institutionalizes normative expectations without formal legal instruments. This article concludes by exploring the implications for AI governance and future export control frameworks in dual-use technologies.
