Have a personal or library account? Click to login
Small Firms, Big Threats: Cybersecurity Research and the Role of Public Policy in the SME Sector Cover

Small Firms, Big Threats: Cybersecurity Research and the Role of Public Policy in the SME Sector

Open Access
|Dec 2025

Figures & Tables

Fig. 1:

PRISMA flow diagram.Source: Prepared by the authors.
PRISMA flow diagram.Source: Prepared by the authors.

Fig. 2:

Publication trend.Source: Prepared by the authors.
Publication trend.Source: Prepared by the authors.

Fig. 3:

Co-occurrence network of keywords (2005–2025).Source: Prepared by the authors.
Co-occurrence network of keywords (2005–2025).Source: Prepared by the authors.

Fig. 4:

Top author productivity over time.Source: Prepared by the authors.
Top author productivity over time.Source: Prepared by the authors.

Fig. 5:

Geographical distribution of SME and cybersecurity research.Source: Prepared by the authors.
Geographical distribution of SME and cybersecurity research.Source: Prepared by the authors.

Top 10 authors by number of citations and by number of documents

AuthorArticlesTCh_indexg_indexm_indexPY_startArticles fractionalized
ARRANZ CFA428341.520240.8
ARROYABE MF428341.520240.8
DE ARROYABE JCF547451.333320231.30
GRANDCLAUDON J417340.37520181.25
JAYAL A446340.620211.2
LEVY Y46220.2520181.33
NCUBUKEZI T48220.333320202.67
PONSARD C417340.27520181.25
PRAKASH E446340.620211.2
SPRUIT M571550.520161.31

Author productivity through Lotka's Law

Documents writtenNo. of authorsProportion of authorsTheoretical
17170.9110.683
2510.0650.171
380.010.076
490.0110.043
520.0030.027

Top 10 publications by number of citations

Author and yearDOITotal citationsTC per yearNormalized TC
FIELDER A, 201610.1016/j.dss.2016.02.01215215.208.98
KABANDA S, 201810.1080/10919392.2018.1484598648.004.87
YILDIRIM EY, 201110.1016/j.ijinfomgt.2010.10.006634.203.99
BENZ M, 202010.1016/j.bushor.2020.03.0106110.175.73
HEIDT M, 201910.1007/s10796-019-09959-1598.435.27
KLJUCNIKOV A, 201910.9770/jesi.2019.6.4(37)557.864.91
TAMVADA JP, 202210.1016/j.techfore.2022.1220885513.754,25
WONG LW, 202210.1016/j.ijinfomgt.2022.1025205313.254,09
GUPTA S, 201810.1108/JOCM-06-2017-0230516.383.88
ARMENIA S, 202110.1016/j.dss.2021.1135805010.004.86

The number and share of individual countries involved in publication activities focused on cybersecurity in SMEs

CountryArticlesFreqSingle-country publicationMultiple-country publicationMCP ratio
The United States280.112620.071
The United Kingdom270.112160.222
South Africa150.061500
China120.051110.083
Germany120.051110.083
Spain120.05930.25
Australia110.04740.364
France70.03430.429
Greece70.03520.286
India70.03520.286

Top 20 most frequently occurring keywords

KEYWORDOCCURRENCESKEYWORDOCCURRENCES
CYBERSECURITY69RISK13
INFORMATION SECURITY48CHALLENGES12
SMES47ADOPTION11
SME38TECHNOLOGY11
MANAGEMENT27INDUSTRY 4 010
SECURITY27MODEL10
RISK MANAGEMENT15BUSINESS9
AWARENESS14CYBERSECURITY AWARENESS9
IMPACT14INFORMATION9
CYBER SECURITY13INNOVATION9

PRISMA 2020 Checklist

Section and topicItem #Checklist itemLocation where item is reported
TITLE
Title1Identify the report as a systematic review.Title page, abstract
ABSTRACT
Abstract2See the PRISMA 2020 for Abstract checklist.Abstract section
INTRODUCTION
Rationale3Describe the rationale for the review in the context of existing knowledge.Introduction section
Objectives4Provide an explicit statement of the objective(s) or question(s) the review addresses.Introduction section
METHODS
Eligibility criteria5Specify the inclusion and exclusion criteria for the review and how studies were grouped for the syntheses.Methods—eligibility criteria
Information sources6Specify all databases, registers, websites, organizations, reference lists, and other sources searched or consulted to identify studies. Specify the date when each source was last searched or consulted.Methods—information sources (Web of Science, search completed June 2025)
Search strategy7Present the full search strategies for all databases, registers, and websites, including any filters and limits used.Methods—search strategy (keywords, filters)
Selection process8Specify the methods used to decide whether a study met the inclusion criteria of the review, including how many reviewers screened each record and each report retrieved, whether they worked independently, and if applicable, details of automation tools used in the process.Methods—selection process (screening by document type, language, subject area)
Data collection process9Specify the methods used to collect data from reports, including how many reviewers collected data from each report, whether they worked independently, any processes for obtaining or confirming data from study investigators, and if applicable, details of automation tools used in the process.Methods—data collection (using Bibliometrix in RStudio)
Data items10aList and define all outcomes for which data were sought. Specify whether all results that were compatible with each outcome domain in each study were sought (e.g., for all measures, time points, analyses), and if not, the methods used to decide which results to collect.Methods—keyword analysis, citation metrics, co-authorship networks
10bList and define all other variables for which data were sought (e.g., participant and intervention characteristics, funding sources). Describe any assumptions made about any missing or unclear information.Methods—additional metadata (publication year, country, document type)
Study risk of bias assessment11Specify the methods used to assess risk of bias in the included studies, including details of the tool(s) used, how many reviewers assessed each study and whether they worked independently, and if applicable, details of automation tools used in the process.Not applicable—no risk of bias assessment conducted
Effect measures12Specify for each outcome the effect measure(s) (e.g., risk ratio, mean difference) used in the synthesis or presentation of results.Not applicable—no effect size or outcome comparison
Synthesis methods13aDescribe the processes used to decide which studies were eligible for each synthesis (e.g., tabulating the study intervention characteristics and comparing against the planned groups for each synthesis [item #5]).Methods—descriptive bibliometric synthesis using Bibliometrix
13bDescribe any methods required to prepare the data for presentation or synthesis, such as handling of missing summary statistics, or data conversions.Methods—descriptive bibliometric synthesis using Bibliometrix
13cDescribe any methods used to tabulate or visually display results of individual studies and syntheses.Methods—descriptive bibliometric synthesis using Bibliometrix
13dDescribe any methods used to synthesize results and provide a rationale for the choice(s). If meta-analysis was performed, describe the model(s) and method(s) to identify the presence and extent of statistical heterogeneity and software package(s) used.Methods—descriptive bibliometric synthesis using Bibliometrix
13eDescribe any methods used to explore possible causes of heterogeneity among study results (e.g., subgroup analysis, meta-regression).Methods—descriptive bibliometric synthesis using Bibliometrix
13fDescribe any sensitivity analyses conducted to assess robustness of the synthesized results.Methods—descriptive bibliometric synthesis using Bibliometrix
Reporting bias assessment14Describe any methods used to assess risk of bias due to missing results in a synthesis (arising from reporting biases).Not applicable—bibliometric study
Certainty assessment15Describe any methods used to assess certainty (or confidence) in the body of evidence for an outcome.Not applicable
RESULTS
Study selection16aDescribe the results of the search and selection process from the number of records identified in the search to the number of studies included in the review, ideally using a flow diagram.Results—study selection, flow of inclusion (n = 286 → 245)
16bCite studies that might appear to meet the inclusion criteria, but which were excluded, and explain why they were excluded.Methods—list of exclusion criteria (e.g., language, document type, topic mismatch)
Study characteristics17Cite each included study and present its characteristics.Results—core publications, tables with citation data
Risk of bias in studies18Present assessments of risk of bias for each included study.Not applicable
Results of individual studies19For all outcomes, present, for each study: (a) summary statistics for each group (where appropriate) and (b) an effect estimate and its precision (e.g., confidence/credible interval), ideally using structured tables or plots.Not applicable—no meta-analysis or comparative statistics
Results of syntheses20aFor each synthesis, briefly summarize the characteristics and risk of bias among contributing studies.Results—descriptive synthesis of themes, authors, journals
20bPresent results of all statistical syntheses conducted. If meta-analysis was done, present for each the summary estimate and its precision (e.g., confidence/credible interval) and measures of statistical heterogeneity. If comparing groups, describe the direction of the effect.
  • Results—descriptive synthesis of themes, authors, journals

  • Results—descriptive synthesis of themes, authors, journals

20cPresent results of all investigations of possible causes of heterogeneity among study results.Results—descriptive synthesis of themes, authors, journals
20dPresent results of all sensitivity analyses conducted to assess the robustness of the synthesized results.Results—descriptive synthesis of themes, authors, journals
Reporting biases21Present assessments of risk of bias due to missing results (arising from reporting biases) for each synthesis assessed.Not applicable
Certainty of evidence22Present assessments of certainty (or confidence) in the body of evidence for each outcome assessed.Not applicable
DISCUSSION
Discussion23aProvide a general interpretation of the results in the context of other evidence.Discussion—synthesis with prior literature
23bDiscuss any limitations of the evidence included in the review.Discussion—thematic and dataset limitations
23cDiscuss any limitations of the review processes used.Discussion—limitations of bibliometric method (e.g., database dependence)
23dDiscuss implications of the results for practice, policy, and future research.Discussion—recommendation section
OTHER INFORMATION
Registration and protocol24aProvide registration information for the review, including register name and registration number, or state that the review was not registered.Review not registered
24bIndicate where the review protocol can be accessed, or state that a protocol was not prepared.No protocol was prepared
24cDescribe and explain any amendments to information provided at registration or in the protocol.Not applicable
Support25Describe sources of financial or nonfinancial support for the review and the role of the funders or sponsors in the review.Funding
Competing interests26Declare any competing interests of review authors.Declarations—no conflict of interest
Availability of data, code, and other materials27Report which of the following are publicly available and where they can be found: template data collection forms, data extracted from included studies, data used for all analyses, analytic code, and any other materials used in the review.Available upon request or documented in Methods

Top 10 journals

SourcesArticlesTCH-indexG-indexM-indexPY_start
Information and Computer Security1094590.52016
Journal of Computer Information Systems452440.42016
Ares 2021: 16th International Conference on Availability, Reliability and Security418340.62021
Computers & Security543350.752022
IEEE Access477340.52020
Technological Forecasting and Social Change386330.62021
2019 IEEE 24th International Workshop on Computer Aided Modeling and Design Of Communication Links and Networks (IEEE CAMAD)214220.2862019
2020 61st International Scientific Conference on Information Technology and Management Science of Riga Technical University (ITMS)212220.3332020
Computers335230.42021
Decision Support Systems2202220.22016

Filter settings on the Web of Science platform

Search timeframe2005 to June 2025
Document typesJournal articles, conference proceedings
LanguageEnglish
FieldsTopic (TS): titles, abstracts, author keywords, Keywords Plus
Thematic areaSample keywords
Small and medium enterpriseTS=((“small business*” OR “small enterprise*” OR “medium business*” OR “medium enterprise*” OR SME OR SMEs OR “micro enterprise*” OR “micro business*” OR “micro, small and medium enterprise*” OR MSME OR MSMEs OR “small and medium-sized business*” OR “small and medium-sized enterprise*” OR “small-to-medium business*” OR “small-to-medium enterprise*” OR SMB OR SMBs)
NEAR/10
Cybersecurity
  • (“cybersecurity” OR “cyber security” OR “cyber-sec*” OR “cyber threat*” OR “cyber attack*” OR “cyber incident*” OR “digital secur*” OR “information secur*” OR infosec OR “network secur*” OR “IT secur*” OR “data secur*” OR “computer secur*”))

  • AND TS=(“threat*” OR “vulnerabilit*” OR “risk*” OR “resilien*” OR “awareness” OR “readiness” OR “preparedness” OR “incident response” OR “compliance” OR “standard*” OR “framework*” OR “solution*” OR “strategy” OR “strategies” OR “management” OR “governance” OR “best practice*” OR “implementation”)

Bibliometric summary of the dataset

DescriptionResultsDescriptionResults
Timespan2005–2025Authors787
Sources (journals, books, etc.)194Authors of single-authored docs14
Documents245Single-authored docs16
Annual growth rate %16.71Co-authors per doc3.63
Document average age5.47International co-authorships %20.41
Average citations per doc7.837Article112
References8219Article; proceedings paper1
Keywords Plus (ID)221Proceedings paper132
Author's keywords (DE)794
Language: English
Page range: 87 - 110
Submitted on: Oct 16, 2025
Accepted on: Nov 22, 2025
Published on: Dec 10, 2025
Published by: University of Matej Bel in Banska Bystrica, Faculty of Economics
In partnership with: Paradigm Publishing Services
Publication frequency: 2 issues per year

© 2025 Matúš Panko, Leoš Šafár, Michal Mešťan, published by University of Matej Bel in Banska Bystrica, Faculty of Economics
This work is licensed under the Creative Commons Attribution 4.0 License.