Managing cybersecurity risks in Small businesses: A simulation-based decision framework

In 2021, the World Economic Forum identified cybersecurity failure, with a risk factor approaching thirteen (Rf = 12.96), as the major technological threat to global communities over the next decade. Given this rising disquiet, the selection and implementation of security software for small-sized businesses is a growing concern in view of the increasing rates of sophisticated attacks and financial losses each year. In this context, small business (SB) security software implementation is an important management task that requires consideration of network components, security protections, management tools, installation complexity, and additional security features. In this study, 106 IT managers provided their perspectives on the selection, procurement, and installation of five (blinded) brands of security software in a simulated SB. Monte Carlo simulations, incorporating key variables such as security software costs, project costs, risk-based contingency levels, and estimated avoided financial losses, were used to assess the likelihood of project success and financial impacts. The simulations demonstrate that SB owners must monitor and contain technical risks in their security software installation projects to reduce the probability of financial losses. Results highlight the importance of tools capable of protecting computing infrastructure and corporate data assets from theft, ransomware threats that significantly reduce SB survival rates, and malware designed to evade detection. Importantly, the Monte Carlo simulations show that SB owners must work to monitor and contain technical risks in their security software installation projects, thereby reducing the opportunities for financial losses to the business. The study suggests that SBs can avert high-cost cybersecurity problems with relatively modest financial outlays.