Small Firms, Big Threats: Cybersecurity Research and the Role of Public Policy in the SME Sector

To explore the intellectual structure and research evolution of cybersecurity in the context of SMEs, this study employs bibliometric analysis as the primary methodological approach. As a systematic and quantitative method for evaluating scientific literature, bibliometrics complements traditional literature reviews by enabling the identification of research clusters, intellectual linkages, and collaborative networks within the academic community (Passas, 2024; Linnenluecke et al., 2019).

For the analysis, the Bibliometrix R-package was utilized within the RStudio environment. This open-source tool allows for comprehensive bibliometric and scientometric analysis, including co-authorship networks, keyword co-occurrences, source dynamics, and thematic evolution. By leveraging the analytical and visualization capabilities of Bibliometrix, the study was able to generate descriptive statistics, conceptual structure maps, and collaboration networks, offering deeper insights into the knowledge base, research trends, and intellectual connections in the field (Aria & Cuccurullo, 2017).

The final dataset for this bibliometric study comprises 245 peer-reviewed journal articles published between 2005 and 2025, all of which are focused on the theme of cybersecurity as it relates to SMEs. Data were collected through targeted keyword searches from two thematic clusters that were carefully selected from terms designed to capture the technical, behavioral, and organizational dimensions of cybersecurity. These included terms such as cybersecurity in SMEs, phishing, insider threat, legacy system vulnerabilities, software supply chain attack, weak passwords, cyber literacy, and the human factor in cybersecurity. The initial keyword search generated a pool of 286 documents, which were systematically filtered on the basis of the following criteria (see Table 1).

A systematic approach was applied in selecting the set of keywords for the bibliometric analysis, with the aim of comprehensively covering the thematic scope of cybersecurity in the context of small and medium-sized enterprises (SMEs). The selected terms reflect not only the technical aspects of cybersecurity but also the organizational, behavioral, and human factors that are critical in this domain. The core set of keywords consisted of terms directly related to cybersecurity in SMEs, incorporating various combinations of expressions such as “SME,” “small business,” “micro enterprise*”* and “cybersecurity,” “cyber threat,” “digital security,”* connected via proximity operators (e.g., NEAR/10) to ensure coverage of terminological variations within the academic literature. A second group of keywords focused on the technical vulnerabilities and common cybersecurity threats faced by SMEs. This included terms such as threat, vulnerability, risk, resilience, framework, compliance, and incident response, which were selected for their high relevance to contemporary security discourse. The third group addressed the human factor and cybersecurity awareness of SMEs. Keywords such as awareness, training, readiness, governance, and best practices were included to capture the importance of organizational culture, education, and employee behavior in shaping the overall cybersecurity posture. The keyword selection was designed to enable a comprehensive mapping of the relevant literature and to facilitate the identification of research trends, key topics, and potential gaps in the field.

The resulting dataset reflects the inherently interdisciplinary nature of cybersecurity within SMEs. Research in this area intersects with technological vulnerabilities, human behavior, organizational policy, and regulatory frameworks. The dataset spans disciplines such as IT management, cybersecurity governance, organizational psychology, information systems, education, and legal compliance, capturing the complexity of cybersecurity readiness in SMEs.

The selection process followed PRISMA guidelines to ensure transparency and replicability. In the identification stage, 286 records were retrieved from the Web of Science database. After the results were limited to journal articles and conference proceedings, 17 nonresearch outputs (e.g., review articles, editorials, book chapters) were excluded, leaving 269 records. During the screening stage, 18 documents unrelated to the subject area (e.g., articles on substance abuse, literature, or parasitology) were removed from the research areas. Finally, 6 articles not written in English were excluded, resulting in a final dataset of 245 records included in the analysis.

Fig. 1:

PRISMA flow diagram.

Source: Prepared by the authors.

Fig. 2:

Publication trend.

Source: Prepared by the authors.

The temporal range of the dataset spans from 2005 to June 2025, enabling a longitudinal analysis of thematic evolution, including emergent and maturing topics such as phishing, vulnerabilities related to remote work, and the increasing focus on human-centered cybersecurity interventions (e.g., awareness, training, and security culture). The inclusion of both technical (e.g., IT security, web application vulnerability, legacy systems) and behavioral (e.g., information security awareness, human factor, governance) terms ensures a holistic perspective on the challenges SMEs face in securing their information infrastructure. This comprehensive filtering approach resulted in a dataset comprising 245 documents, involving 787 authors, and capturing 794 author keywords and 221 Keywords Plus. The methodologically rigorous, thematically coherent, and empirically grounded dataset serves as a solid foundation for analyzing scholarly output, research impact, and intellectual developments in the cybersecurity SME domain.

Table 2 provides an overview of the bibliometric characteristics of the final dataset comprising 245 documents published between 2005 and June 2025. These documents were sourced from 194 different publication outlets, including academic journals and conference proceedings. Annual scientific production has exhibited a robust growth trend, with an average annual growth rate of 16.71%. The average age of the documents is 5.47 years, indicating a relatively recent focus on the topic. On average, each document received 7.84 citations, and the dataset as a whole contained 8,219 references. In terms of content, the dataset includes 221 Keywords Plus (extracted from titles of cited references) and 794 author-supplied keywords, reflecting a diverse range of thematic interests within the cybersecurity-SME intersection. The authorship analysis reveals contributions from 787 unique authors, with only 14 documents authored by a single researcher. Out of the 245 documents, 16 were single-authored, while the average number of co-authors per document was 3.63. Notably, 20.41% of the publications involved international co-authorship, indicating a significant degree of global collaboration. Regarding document types, the dataset consists of 112 journal articles, 132 conference proceedings, and 1 hybrid document labeled as both an article and a proceedings paper. This distribution underscores the relevance of both academic and applied research in this domain.

Figure 2 illustrates the annual evolution of academic publications focusing on cybersecurity in the context of SMEs from 2005 to 2025. The trend demonstrates a clear increase in research output over time, with notable fluctuations and several periods of accelerated growth. While the early years (2005–2014) are characterized by relatively low and inconsistent publication activity, a gradual upward trajectory becomes evident from 2015 onward. A sharp increase in publications is observed between 2018 and 2020, followed by another significant surge between 2022 and 2024, culminating in a peak in 2024, with more than 35 documents published. This peak reflects heightened scholarly interest in the intersection of digital transformation and cybersecurity challenges within SMEs—potentially influenced by external factors such as the COVID-19 pandemic, increased remote work, and global policy focus on digital resilience. Although a decline is visible in 2025, this may be partially attributed to data incompleteness for the current year. Overall, the trend reveals a growing academic recognition of the relevance of cybersecurity for SMEs, with a compound annual growth rate of approximately 16.7%. Despite this positive momentum, the historical underrepresentation of this topic—especially in the first half of the analyzed period—suggests that the field remains relatively underexplored. Continued research is necessary to address the evolving threat landscape and support SMEs in developing effective cyber resilience strategies through evidence-based insights and interdisciplinary frameworks.

The analyzed table captures the 20 most frequently occurring keywords identified through bibliometric analysis of documents related to cybersecurity and small and medium-sized enterprises (SMEs). These keywords, extracted and clustered via VOSviewer, offer a window into the prevailing research themes, terminological patterns, and conceptual priorities within the literature. The keywords “cybersecurity” (69 occurrences) and “information security” (48 occurrences) clearly dominate the landscape, reflecting the central disciplinary anchor of the dataset. The co-occurrence of both terms underlines the close interlinkage between practical cybersecurity implementations and the broader domain of information protection. Interestingly, “cyber security” appears as a separate variant (13 occurrences), signaling inconsistencies in author keyword formatting, which is common in bibliometric datasets but conceptually convergent. Keywords directly referencing small and medium-sized enterprises—“SMEs” (47 occurrences) and “SME” (38 occurrences)—demonstrate the corpus's strong alignment with the SME context. Although variably abbreviated or singular/plural, these terms confirm the analytical focus on business entities that typically face resource constraints and heightened vulnerability to cyber threats. Their consistent appearance affirms the importance of understanding cybersecurity within the structural and strategic limitations unique to SMEs. Risk-related keywords such as “risk management” (15 occurrences) and “risk” (13 occurrences) highlight the literature's preoccupation with threat mitigation and organizational resilience. These themes reflect a mature stage in the research trajectory, where cybersecurity is increasingly framed not just as a technical problem but also as a managerial and operational challenge requiring proactive governance. The appearance of “awareness” (14) and “cybersecurity awareness” (9) points to the growing recognition of human-centered vulnerabilities in cybersecurity research. In the SME environment, where formal IT departments may be absent or limited, raising awareness among nontechnical staff becomes a vital line of defense against cyber threats such as phishing or insider attacks. Keywords such as “adoption” (11), “technology” (11), “innovation” (9), and “Industry 4.0” (10) signal a research emphasis on the integration of digital technologies within SMEs. This aligns with global trends in smart manufacturing and digital transformation, where the benefits of innovation are paralleled by heightened exposure to cyber risks. The link between cybersecurity and technology adoption is thus a recurring point of analysis. The presence of terms such as “management” (27), “impact” (14), “model” (10), and “business” (9) suggests that scholars increasingly conceptualize cybersecurity not only as a technical safeguard but also as a strategic, managerial concern. The modeling of cybersecurity risks and their business impacts is particularly relevant in helping SMEs allocate limited resources toward effective digital protection.

The keyword occurrence distribution confirms that current research on SMEs and cybersecurity spans both technical domains (e.g., information security, risk, technology) and organizational/strategic considerations (e.g., management, awareness, adoption). The integration of Industry 4.0 and digital adoption themes suggests a strong orientation toward innovation-driven transformation within SMEs. Moreover, repeated references to awareness and risk management emphasize the importance of holistic, organization-wide cybersecurity preparedness. Together, these findings point to a multidimensional research landscape—one that bridges technology, strategy, and human factors in addressing the cybersecurity needs of SMEs.

The co-occurrence network graphically maps the conceptual structure of the literature on cybersecurity in the context of SMEs on the basis of keyword frequency and linkage. The largest node, “cybersecurity,” sits at the center of the network, reflecting its dominant role in the research field. Its strong connections to multiple clusters highlight its interdisciplinary nature and centrality in various thematic discussions. Adjacent to “cybersecurity” are keywords such as “risk management,” “cybercrime,” “machine learning,” and “digitalization,” indicating frequent co-occurrence and suggesting a close thematic relationship. This cluster emphasizes both the technical and strategic aspects of cybersecurity, particularly its intersection with digital transformation and intelligent systems.

The keywords “SMEs,” “SME,” and “information security” form another dense cluster, reinforcing the core focus on SMEs. These terms are strongly linked to themes such as “ISO 27001,” “training,” “management,” and “cybersecurity framework,” highlighting organizational responses to cybersecurity challenges, including the implementation of standards and policy-driven practices. Smaller, more peripheral clusters—such as those around “governance,” “industry 5.0,” “internet of things,” and “privacy”—indicate emerging or niche areas of interest. Although less central, they suggest directions for future exploration, particularly in terms of adapting to new technologies and societal demands. The color-coded groupings reveal thematic subdomains, including technical mechanisms (e.g., AI, blockchain), strategic implementation (e.g., policies, training), and socio-organizational concerns (e.g., awareness, culture, governance). This structure points to a growing integration of technical and managerial perspectives within the field. Overall, network visualization underscores the multidimensional and evolving nature of cybersecurity research in SMEs, with strong cross-linkages between risk, innovation, organizational capability, and digital readiness.

Fig. 3:

Co-occurrence network of keywords (2005–2025).

Source: Prepared by the authors.

A critical component of bibliometric assessment is the evaluation of scholarly influence not only through total output and citation counts but also through nuanced metrics, such as the h-index, g-index, m-index, and fractionalized authorship contribution. In the context of cybersecurity and SMEs, these indicators reveal the relative academic weight and trajectory of individual researchers, offering a multidimensional view of intellectual leadership and emerging influence. Among the top contributors, SPRUIT M stands out as the most influential figure in terms of raw citation performance, with 71 total citations across five publications and the highest h-index (5) and g-index (5) in the dataset. With a PY_start of 2016, this indicates sustained scholarly engagement over nearly a decade. His m-index of 0.5 (citational impact normalized by years since first publication) further confirms a steady influence trajectory. His fractionalized contribution (1.31) suggests substantial personal input across co-authored works. Similarly, DE ARROYABE JCF combines a robust citation count (47) with strong bibliometric indices—h-index 4, g-index 5, and a high fractionalized authorship score (1.30)—despite a relatively recent entry into the field (PY_start: 2023). His m-index of 1.33 reflects rapid impact acceleration, suggesting that his contributions are not only visible but also gain traction at an impressive rate. The performance profiles of the ARRANZ CFA and ARROYABE MF are identical: each with 4 articles, 28 citations, an h-index of 3, a g-index of 4, and an m-index of 1.5, indicating exceptionally fast citation accumulation since their first publications in 2024. Their fractionalized contributions (0.8) point to balanced collaborative roles, possibly as part of coled or team-based research structures. This unusually high m-index (above 1.0) signals a sharp rise in influence over a very short time span, likely attributable to recent publications in high-visibility outlets or timely topics such as AI, cybersecurity risk in SMEs, or policy-related frameworks. Both JAYAL A and PRAKASH E have 4 articles, 46 citations, and matching h- and g-indices (3 and 4, respectively). Their m-index (0.6) suggests consistent academic engagement since 2021, whereas their fractionalized authorship (1.2) denotes active and possibly leading roles in their research collaborations. They may contribute heavily to applied, managerial, or technical aspects of cybersecurity strategies within SMEs. GRANDCLAUDON J and PONSARD C present similar profiles as methodologically oriented contributors, each with 4 articles, 17 citations, an h-index of 3, and a modest m-index (0.375 and 0.275, respectively). Their PY_start of 2018 suggested that they have maintained moderate, steady scholarly activity over several years. Fractionalized values over 1.2 may hint at primary authorship or fewer co-authors per paper. LEVY Y and NCUBUKEZI T present lower total citation counts (6 and 8, respectively) and h-index values of 2, reflecting early stage or niche influence. Notably, NCUBUKEZI T shows the highest fractionalized authorship (2.67) in the dataset, indicating a disproportionately large personal contribution to their work—potentially as a sole or lead author in smaller teams. However, the m-index values (0.25 and 0.3333) are relatively low, suggesting limited citation momentum thus far.

This author-level analysis provides a richer understanding of influence within the field of SME cybersecurity by incorporating multiple metrics, not just total output or citation volume. Scholars such as SPRUIT M, DE ARROYABE JCF, and the ARRANZ-ARROYABE team emerge as key figures with high academic impact relative to their output and time activity. Their elevated h- and m-indices, especially within recent publishing years, suggest fast-rising trajectories and central roles in shaping emerging discourses. The inclusion of fractionalized authorship adds further clarity to the depth of involvement, distinguishing between lead contributors and those more peripherally involved in co-authored works. Collectively, these insights reinforce the notion of a rapidly evolving research landscape, driven by a mix of established scholars and agile newcomers advancing the frontier of cybersecurity resilience in SMEs.

Fig. 4:

Top author productivity over time.

Source: Prepared by the authors.

Lotka's Law provides a theoretical framework for understanding author productivity patterns in the scientific literature. It posits that a majority of authors contribute only one publication to a given field and that the number of authors publishing multiple documents decreases exponentially with the number of publications. The data from the analyzed corpus align closely with this theoretical expectation. Specifically, 91.1% of the authors have authored only one publication, which exceeds the theoretical prediction of 68.3%. This suggests that the research field—cybersecurity in the context of SMEs—is characterized by a high proportion of occasional contributors. These may include scholars from adjacent disciplines or practitioners engaging in collaborative, one-time research efforts. The proportion of authors who have written two (6.5%) or three (1%) documents falls below the theoretical values, and only two authors (0.3%) have published five articles, highlighting the limited presence of highly prolific contributors. This skewed distribution suggests that the field is still emerging and fragmented, lacking a concentrated core of scholars who consistently publish in this niche area. While interdisciplinary collaboration can be a strength, the absence of a larger group of recurring contributors may hinder the accumulation of deep, specialized knowledge and continuity in theory building. The discrepancy between the observed and theoretical proportions also points to the potential for greater consolidation of expertise. The development of a stronger cohort of dedicated researchers could enhance methodological consistency, strengthen conceptual frameworks, and facilitate long-term research agendas. Overall, the Lotka-based productivity analysis indicates that while the field is drawing broad interest, its intellectual foundation remains diffuse, signaling an opportunity for future scholarly consolidation and leadership.

The bibliometric analysis of country-level contributions reveals insightful patterns in global academic production related to cybersecurity within the SME context. The data highlight both the quantity and collaborative nature of research outputs across key contributing nations. The United States ranks first, with 28 publications, representing 11% of the total dataset. The overwhelming majority (26) are single-country publications, with only two involving international collaboration, resulting in a relatively low multiple-country publication (MCP) ratio of 0.071. This suggests a predominantly domestic research focus, which may reflect strong institutional capabilities and funding mechanisms within the U.S. academic ecosystem that reduce reliance on international co-authorship. Closely following is the United Kingdom with 27 publications (11% frequency), but with a higher degree of international engagement—6 of its publications involve cross-border collaboration, leading to an MCP ratio of 0.222. This underscores the UK's active participation in international cybersecurity networks and research consortia, likely supported by its integration in pan-European research initiatives, particularly in the post-Brexit context, where digital resilience remains a strategic national priority. South Africa ranks third with 15 publications (6%), all of which are single-country outputs, resulting in an MCP ratio of 0. This absence of international co-authorship may reflect a localized research agenda, possibly driven by national policy priorities and institutional independence in cybersecurity development for SMEs.

Both China and Germany contribute 12 publications each (5% frequency), with one internationally co-authored paper per country. Their modest MCP ratios (0.083) point to a relatively self-contained research structure, despite both nations being significant global players in digital infrastructure and innovation. Spain, with 12 publications, also exhibits greater openness to collaboration, with three multicountry outputs and an MCP ratio of 0.25. Australia has the highest level of international collaboration among the top contributors. With 11 publications (4%), 4 are co-authored with foreign institutions, yielding an MCP ratio of 0.364. This suggests a strong strategic orientation toward global research integration, which is consistent with the country's policy alignment toward regional digital cooperation and cyber capacity building. France, Greece, and India each report 7 publications (3% each) but differ notably in collaborative intensity. France has the highest MCP ratio among all listed countries (0.429), with nearly half of its publications involving international partners. Greece and India also display moderate collaboration levels, with an MCP ratio of 0.286. These values highlight the strategic importance of international networks in fostering knowledge exchange and advancing cybersecurity resilience, particularly in regions where SMEs face growing exposure to cyber threats but may lack sufficient domestic support structures.

Collectively, the data reflect a globally dispersed research landscape with notable regional disparities in publication volume and collaborative behavior. Countries such as Australia, the United Kingdom, and France exemplify integrative research ecosystems, whereas others, such as South Africa and the United States, appear to focus more heavily on domestic academic production. These patterns carry implications for future policy and funding strategies, suggesting a need to incentivize broader international research cooperation to address the increasingly transnational nature of cybersecurity threats facing SMEs.

Fig. 5:

Geographical distribution of SME and cybersecurity research.

Source: Prepared by the authors.

This refined bibliometric overview identifies the most impactful scholarly publications that bridge the intersection of cybersecurity and SMEs, utilizing a combination of total citation count, annual citation performance, and normalized citation rates. These multidimensional indicators offer a more nuanced picture of a publication's influence over time and within its scholarly context. At the forefront is Fielder et al. (2016), with a total of 152 citations, achieving an impressive 15.2 citations per year and a normalized citation count of 8.98. This paper has emerged as a foundational study, shaping the academic discourse on decision-making frameworks and risk-based models in SME cybersecurity. Its high normalized citation score confirms sustained academic attention relative to publication age. Second, Kabanda et al. (2018) garnered 64 citations, with an 8.00 annual rate and a normalized impact of 4.87. Their work, published in a cybersecurity policy context, delves into behavioral and organizational dynamics, emphasizing the importance of SME-specific security practices in developing economies. Yildirim et al. (2011), despite being the oldest publication on the list, maintain relevance, with 63 citations and a steady annual citation rate (4.20). Its normalized TC of 3.99 suggests a consistent long-term impact, reflecting its early contributions to information security management practices tailored to SMEs. Recent publications have also demonstrated strong early influences. Benz et al. (2020) and Heidt et al. (2019) each accumulated over 59–61 citations, with high yearly rates (10.17 and 8.43, respectively), indicating rapid uptake in current academic and practitioner circles. Their research explores innovation resistance, digital transformation challenges, and the integration of cybersecurity into strategic business models for SMEs. Notably, Kljucnikov et al. (2019), representing Central and Eastern Europe, provide a regionally grounded perspective on cybersecurity readiness, earning 55 citations and maintaining a solid normalized citation rate of 4.91, signaling cross-regional relevance. Among the newest entries, Tamvada (2022) and Wong et al. (2022) show remarkable momentum, with over 13 citations per year, despite their short citation window. Their research highlights SME preparedness in the face of disruptive technologies and evolving cyber threats, offering early signs of becoming future landmark studies. Gupta (2018) and Armenia (2021) round out the top 10 with 51 and 50 citations, respectively. Both studies focus on change management and simulation modeling for cyber risk, with balanced performance across all indicators. In conclusion, this set of publications forms the intellectual backbone of SME-focused cybersecurity literature. While citation counts alone offer initial insights, integrating time-adjusted metrics such as citations per year and normalized citation rates helps identify not only which articles are most referenced but also which ones shape the current and future academic narrative. These works underscore the field's transition from exploratory analysis to applied, strategy-oriented research, especially within the rapidly evolving risk landscape of SMEs.

This extended performance assessment offers deeper bibliometric insight into the scholarly venues contributing to cybersecurity research in the context of small and medium-sized enterprises (SMEs). In contrast to traditional counts of articles or citations alone, the following analysis integrates composite metrics—the h-index, g-index, m-index, and publication onset (PY_start)—to reflect not only productivity and impact but also the temporal consistency and citation velocity of each source. At the top of the list is Information and Computer Security, with 10 articles, a total citation count (TC) of 94, and an h-index of 5—making it the most consistently cited journal in this collection. Its g-index of 9 and m-index of 0.5 suggest a reliable and steady academic contribution to the SME cybersecurity discourse since 2016, particularly in terms of organizational security strategies and data protection frameworks tailored to SMEs. Next, the Journal of Computer Information Systems has published 4 articles that together amassed 52 citations, with an h-index and g-index of 4. This journal, which has also been active since 2016, plays a notable role in information management and business systems, offering a blend of technical and managerial perspectives relevant for SMEs adapting to cybersecurity challenges. The ARES Conference (2021)—a prominent venue focused on Availability, Reliability, and Security—shows impressive engagement, with 4 papers, 18 citations, and an h-index of 3. Despite its recent entry in 2021, its m-index of 0.6 reflects rapid citation activity, underlining its role in fostering discussion on applied and emerging topics in SME cybersecurity. Computers & Security, a discipline-focused journal, follows with 5 articles and 43 citations, establishing a solid h-index of 3 and a relatively high m-index of 0.75, the highest among all sources. This suggests not only the technical credibility of this journal but also its current relevance, with all included articles published since 2022—making it a key emerging source for high-impact research. IEEE Access, known for its open-access model and rapid dissemination, contributed 4 articles and 77 citations, with a g-index of 4 and an m-index of 0.5. Although more generalist in scope, its large and multidisciplinary audience supports fast visibility for SME-focused cybersecurity research, especially at the systems and infrastructure level. Technological forecasting and social change, with 3 papers and 86 citations, maintains a g-index of 3 and a healthy m-index of 0.6, indicating that forward-looking studies on cybersecurity and SME resilience are gaining traction. The journal's orientation toward innovation, foresight, and strategic planning makes it particularly suitable for long-term digital transformation narratives. Several conference proceedings are also influential. Notably, the IEEE CAMAD 2019 Workshop and the ITMS 2020 Conference each contributed 2 papers with moderate citation counts (14 and 12, respectively). Both show h-index values of 2 and m-indices above 0.28, indicating consistent engagement within focused research communities related to network design and digital systems in SMEs. The journal Computers, with 3 articles and 35 citations, combines technical depth with practical applicability, sustaining a g-index of 3 and an m-index of 0.4 since 2021. Finally, Decision Support Systems stands out for their extraordinary citation impact: while only 2 articles were published, they generated 202 citations, achieving the highest citation density of all venues. Although the m-index is relatively low (0.2) because it started earlier in 2016, the data suggest that the contributions presented here are foundational or highly influential and are often cited in theoretical and policy-level research on strategic cybersecurity decision-making.

This analysis reveals that SME cybersecurity research is being disseminated across a diverse spectrum of journals and conferences, spanning domains such as information security, digital innovation, business systems, and technical engineering. The inclusion of both long-standing academic journals and emerging high-impact conferences indicates that the field is maturing and becoming increasingly interdisciplinary. Importantly, metrics such as the m-index and g-index help identify not only where research is published but also where it is gaining sustained and growing influence—an essential factor in strategic publication planning and knowledge dissemination.

The bibliometric findings revealed that several highly cited studies indirectly address the influence of public policy and regulation on cybersecurity practices in small and medium-sized enterprises (SMEs). For instance, Kabanda et al. (2018) examined cybersecurity behaviors in developing economies, emphasizing that the absence of clear regulatory frameworks and limited institutional support hinder the implementation of even basic security controls. Their study underscores that regulatory guidance and government-backed awareness programs are crucial for cultivating cybersecurity readiness among resource-constrained firms. Similarly, Heidt et al. (2019) discussed the governance dimension of digital transformation, highlighting that compliance requirements, such as those derived from the General Data Protection Regulation (GDPR), serve as external drivers compelling SMEs to adopt structured cybersecurity practices. In Central and Eastern Europe, Kljucnikov et al. (2019) found that the adoption of cybersecurity standards remains uneven largely due to weak national coordination mechanisms and insufficient financial incentives for small businesses. These observations align with Tamvada et al. (2022), who demonstrated that the successful adoption of Industry 4.0 technologies in emerging economies depends not only on technological readiness but also on the existence of enabling public policies that promote security capacity building.

These bibliometric insights collectively indicate that the regulatory and policy environment acts as a decisive external enabler or barrier to cybersecurity maturity within SMEs. In the European context, several policy instruments have redefined this environment. The NIS2 Directive (EU 2022/2555) expands the obligations of member states to strengthen national cybersecurity capacities and explicitly addresses supply chain dependencies, which indirectly affect SMEs participating in critical sectors. The Cyber Resilience Act (2024) further extends these responsibilities by imposing security-by-design and postmarket surveillance requirements on producers of digital products and software components. These frameworks not only elevate baseline security expectations but also encourage SMEs to align their internal processes with harmonized European standards.

At the national level, strategies such as the National Cybersecurity Strategy of the Slovak Republic 2021–2025 provide the domestic translation of EU-level priorities. They introduce instruments for SME support, including education initiatives, sectoral training programs, and partnerships with academia. However, empirical studies and ENISA reports (2025) reveal persistent gaps in awareness and the practical implementation of these measures. Many SMEs remain unaware of available state support or consider compliance too complex and costly, which leads to a regulatory divide between large enterprises and smaller actors. The same issue was identified in the bibliometric corpus, where studies emphasize that information asymmetry and limited administrative capacity prevent SMEs from effectively leveraging policy frameworks (Uchendu et al., 2021; Carrapico & Barrinha, 2017). Public institutions such as ENISA and national CSIRT centers, therefore, play a critical intermediary role. By providing simplified guidelines, online risk assessment tools, and funding schemes under the EU Digital Europe Program, they help translate regulatory intent into practical actions. Yet, the bibliometric evidence also indicates that awareness of these initiatives remains low, suggesting that the effectiveness of public policy depends on its accessibility and contextualization for SMEs. From a conceptual standpoint, the interplay between regulation and organizational behavior can be interpreted through the lens of institutional theory, where coercive pressures (legal compliance), normative pressures (industry expectations), and mimetic pressures (peer imitation) collectively shape SME cybersecurity adoption. Effective public policy must, therefore, balance prescriptive regulation with supportive capacity-building measures. In line with the formulated Research Question, future research should assess to what extent European and national policy instruments genuinely enhance cybersecurity resilience at the firm level and how these mechanisms can be optimized to support SMEs within an integrated, multilevel governance system.

The results demonstrate a consistent increase in the volume of research dedicated to cybersecurity in SMEs, with an average annual growth rate of 16.7%. This trend aligns with the rising number of cyber incidents targeting SMEs, as well as regulatory initiatives aimed at strengthening digital security (e.g., NIS2, GDPR). Keyword analysis confirmed a shift in research focus from purely technical aspects (e.g., firewalls, encryption) to strategic and behavioral approaches (e.g., cybersecurity awareness, risk management, digital literacy). This development reflects a broader understanding of cybersecurity as a socio-technical phenomenon. Notably, terms such as “awareness,” “training,” and “governance” were frequently associated with SMEs, indicating a growing emphasis on practical and organizationally embedded solutions. In addition, bibliometric evidence suggests an increasing recognition of the role of public policy and regulation as external drivers of SME cybersecurity maturity. Studies frequently referenced frameworks such as the EU NIS2 Directive, the Cyber Resilience Act (2024), and GDPR, highlighting how compliance obligations, national strategies, and EU-level initiatives act as catalysts for organizational change. This reflects a research trend where cybersecurity in SMEs is not viewed solely as a managerial or technical challenge but also as a governance and policy issue shaped by multilevel regulatory environments. Geographical analysis revealed dominance by countries such as the United States and the United Kingdom in terms of absolute publication volume, while countries like France and Australia demonstrated high levels of international collaboration. Cybersecurity research in SMEs is, therefore, not only technically diverse but also globally distributed, pointing to the need for context-sensitive strategies. The application of Lotka's Law revealed that most authors contributed only one publication to the field, which suggests a fragmented research community. This fragmentation presents an opportunity for the consolidation of the field through the formation of stable research networks and collaborative working groups.

While the bibliometric method provides a robust and transparent overview of the development of a research field, it also has limitations. First, the analysis was based exclusively on the Web of Science database. Although this ensures a high quality of included publications, it excludes relevant studies from other databases, such as Scopus, IEEE Xplore, and Google Scholar, which could lead to a partial view of the topic. Second, the search string and keyword selection may have influenced the scope of the included documents. Although the search strategy was systematic and designed to reflect thematic variation, a degree of selection bias cannot be ruled out. Third, bibliometric analysis relies primarily on quantitative indicators and cannot capture the depth, quality, or contextual significance of individual publications. For instance, a high citation count does not necessarily imply positive impact or methodological rigor. Finally, given that the review includes studies published through mid-2025, recently published articles may not yet have accumulated sufficient citations to reflect their influence, which may skew impact-related metrics.

The findings of this study are consistent with previous research that confirms the vulnerability of SMEs to cyber threats and the need for more than just technical solutions (e.g., Bada & Nurse, 2019; Uchendu et al., 2021). However, this study extends the literature by mapping thematic clusters and dominant discourse lines through bibliometric network analysis (e.g., security standards, gamification, ISO 27001). The thematic focus of publications has clearly evolved. Older studies concentrated on basic threats (e.g., viruses, data protection), while more recent work emphasizes resilience models, employee training, and security culture. This indicates maturation of the research field. This study also confirms the absence of standardized frameworks tailored to SMEs, as highlighted by organizations like ENISA. On the other hand, studies such as Tamvada et al. (2022) demonstrate regional disparities in the implementation of Industry 4.0 among SMEs, which is mirrored in the geographical distribution of literature.

From a research perspective, this study advocates greater interdisciplinary collaboration among technical, managerial, and behavioral sciences. Future research should prioritize longitudinal studies to evaluate the effectiveness of cybersecurity awareness interventions and training programs in SMEs. It is also essential to develop regional cybersecurity preparedness indices tailored specifically for small firms. In terms of practice, the study supports the use of gamified tools (e.g., CySecEscape 2.0) and scalable training models for raising cybersecurity awareness among employees. Organizations can use the findings to select appropriate standards and frameworks that are realistically implementable in the SME context. Policy implications include the need to harmonize cybersecurity regulations and provide support mechanisms for smaller businesses that face compliance requirements without adequate resources. Simplified ISO 27001 implementation methodologies, GDPR compliance guidelines for SMEs, and the public funding of educational tools can help enhance the resilience of the digital SME sector. In conclusion, this bibliometric analysis contributes to the understanding of the intellectual, geographical, and thematic structure of cybersecurity research in SMEs and provides a foundation for evidence-based, context-aware strategies aimed at improving digital resilience in this vital economic sector.