Towards Designing A Method To Create Sticky Information Security Training For SMEs: Identifying Design Factors

Martin Brehmer, Antragama Ewa Abbas, Nageswaran Vaidyanathan

Research output: Chapter in Book/Report/Conference proceedingArticle in proceedingsResearchpeer-review


The risk of being impacted by a cyberattack is high, because of more professional attacks. Thereby, cyber criminals are bypassing technological countermeasures through tricking users. Recently collected data during the SARS-CoV-2 pandemic demonstrate, that cyberattacks including social engineering are among the main threats, especially for Small and Medium-sized Enterprises (SME). (Information) Security Education and Training Awareness (SETA) is proposed to be an effective countermeasure. However, the effects of SETA fade rapidly over time and learnings are not applied in practice sustainably. Thus, we state that a method is required to create SETA programs with sustainable learning outcomes for SME. To develop such a method, we follow the Design Science Research Methodology and share insights of our first design cycle in this article. We conducted a literature review and analyzed factors of failure and success regarding the design of sustainable SETA programs. Furthermore, we sketch our plans for design cycle 2.
Original languageEnglish
Title of host publicationProceedings of the 29th European Conference on Information Systems (ECIS)
Number of pages13
Place of PublicationAtlanta, GA
PublisherAssociation for Information Systems. AIS Electronic Library (AISeL)
Publication date2021
Article number1473
Publication statusPublished - 2021
EventThe 29th European Conference on Information Systems (ECIS) 2021: Human Values Crisis in a Digitizing World - Virtual Conference, Marrackech, Morocco
Duration: 14 Jun 202114 Jun 2021
Conference number: 29


ConferenceThe 29th European Conference on Information Systems (ECIS) 2021
LocationVirtual Conference
Internet address
SeriesProceedings of the European Conference on Information Systems


  • Information security
  • Training
  • Education
  • Awareness
  • SETA
  • DSR
  • SME

Cite this