Overview

This workshop emphasises dialogue, reflection, and collective sense making around researching security, privacy, and trust in SME contexts.

Workshop Scope and Focus

Small and Medium-sized Enterprises (SMEs) play a central role in the economy, yet they face distinctive and often under examined challenges around cybersecurity, privacy, and trust. Compared to large organisations, SMEs typically operate with limited resources, informal structures, and close personal relationships between owners, employees, customers, and suppliers. These characteristics shape how security and privacy practices are understood, adopted, and lived in everyday work.

The challenges faced by SMEs sit at the intersection of organisational practice, regulatory environments, economic constraints, and human and psychological factors such as risk perception, trust, responsibility, and decision making. Despite their importance, these issues remain relatively understudied in comparison to research focused on large enterprises.

The SME-CPT workshop brings together academics, researchers and early career researchers, who study SMEs and related topics in cybersecurity, privacy, and trust, from a wide range of disciplinary perspectives, including computing, management, psychology, sociology, and law. The aim is to create a small, interactive space for sharing ideas, discussing work in progress, and building relationships across fields. Rather than prioritising polished results, the workshop emphasises dialogue, reflection, and collective sense making around the realities of researching security, privacy, and trust in SME contexts.

SME-CPT is organised by the CyCOS project and hosted at the University of Kent in Canterbury. It is intended to support the development of a connected and interdisciplinary research community around SMEs, cybersecurity, privacy, and trust.

Workshop Programme

Keynote 1: The Cyber Resilience Pledge 

Tom Howes, Department for Science, Innovation and Technology (DSIT)

Session 1: SME cyber risk, governance and decision-making

• Cybersecurity and Cyber insurance for SMEs: Perceptions, challenges and decision-making dynamics (Rodney Adriko)
• Cybersecurity controls and policies in micro and small businesses by behavioural type: Evidence from the UK (Edward Cartwright and Anna Cartwright)
• Understanding Cyber Risk Monitoring Needs in SMEs: A Preliminary Stakeholder Study (Emma Berry)

Keynote 2: Motivating small organisations to take action 

National Cyber Security Centre (NCSC) Representative

Session 2: Awareness, susceptibility, training and knowledge gaps 

• Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity (Carlos Rombaldo Junior)
• Phishing susceptibility through an SME lens: Findings from a systematic literature review (Mark Spicer)
• Measuring Cybersecurity Training Engagement Using Webcam-Based Eye Tracking: A Position Paper (John McAlaney)
• Sex Work is Work: A Systematisation of the Lack of Knowledge in digital business cyber security literature (Lucy Davies)

Session 3: Emerging risks, resilience and cross-cutting perspectives

• Still the Same, the Beat Goes On (Murray Jennex)
• Translating Crypto Fraud Detection Design Principles for SME Cyber Resilience (Asma Patel)
• The Dependency Divide: How Frontier AI Redistributes Cyber Risk across the SME Ecosystem (Marta F Arroyabe, Carlos F.A. Arranz, Nacho Fernandez)

Workshop Organisation

Workshop Co-Chairs

Jason R.C. Nurse (University of Kent, UK)
Maria Bada (Queen Mary, University of London, UK)
Steven Furnell (University of Nottingham, UK)

Programme Committee 

Ingolf Becker (UCL, UK)

Anna Cartwright (Independent Researcher, UK)
Edward Cartwright (De Montfort University, UK)
Yulia Cherdantseva (Cardiff University, UK)

Murray Jennex (West Texas A&M University, USA)

Vasilis Katos (Bournemouth University, UK)
Jacques Ophoff (Abertay University, UK)
Emmanouil Panaousis (University of Greenwich, UK)

Asma Patel (Aston University, UK)
Karen Renaud (Strathclyde University, UK)

Organising Committee

Ram Herkanaidu (University of Nottingham, UK)
Neeshé Khan (University of Nottingham, UK)
Matthew Rand (Queen Mary, University of London, UK)