Small and Medium Enterprises (SMEs) are increasingly exposed to cyber risks. Some of the main reasons include budget constraints, the employees’ lack of cybersecurity awareness, cross-sectoral cyber risks, lack of security practices at organizational level, and so on. To equip SMEs with appropriate tools and guidelines that help mitigate their exposure to cyber risk, we must better understand the SMEs’ context and their needs. Thus, the contribution of this paper is a survey based on responses collected from 141 SMEs based in the UK, where the objective is to obtain information to better understand their level of cybersecurity awareness and practices they apply to protect against cyber risks. Our results indicate that although SMEs do apply some basic cybersecurity measures to mitigate cyber risks, there is a general lack of cybersecurity awareness and lack of processes and tools to improve cybersecurity practices. Our findings provide to the cybersecurity community a better understanding of the SME context in terms of cybersecurity awareness and cybersecurity practices, and may be used as a foundation to further develop appropriate tools and processes to strengthen the cybersecurity of SMEs.

Humans are the weak link in cybersecurity, hence, this paper considers the human factor in cybersecurity and how the customer journey approach can be used to increase cybersecurity awareness. The Customer Journey Modelling Language (CJML) is used to document and visualise a service process. We expand the CJML formalism to encompass cybersecurity and develop an easy-to-use web application as a supporting tool for training and awareness. We present the results from the usability test with ten persons in the target group and report on usability and feasibility. All participants managed to finish the test, and most participants indicated that the tool was easy to use. By using the tool, non-expert users can make user journey diagrams showing basic conformance in a short time without professional training. For the threat diagram, half of the users achieved full conformance. In conclusion, the tool can serve as low-threshold cybersecurity awareness training for SME employees. We discuss th e limitations and validity of the results and future work to improve the tool’s usability.

Abstract Although numerous methods for handling the technical aspects of developing domain-specific modeling languages (DSMLs) have been formalized, user needs and usability aspects are often addressed late in the development process and in an ad hoc manner. To this concern, this paper presents the development of the customer journey modeling language (CJML), a DSML for modeling service processes from the end-user’s perspective. Because CJML targets a wide and heterogeneous group of users, its usability can be challenging to plan and assess. This paper describes how an industry-relevant DSML was systematically improved by using a variety of user-centered design techniques in close collaboration with the target group, whose feedback was used to refine and evolve the syntax and semantics of CJML. We also suggest how a service-providing organization may benefit from adopting CJML as a unifying language for documentation purposes, compliance analysis, and service innovation. Finally, we distill what we learned into general lessons and methodological guidelines.

Although numerous methods have been formalized for handling the technical aspects of developing domain-specific modeling languages (DSMLs), user needs and usability aspects are often addressed in ad hoc manners and late in the development process. Working in this context, this paper presents the development of the customer journey modeling language (CJML), a DSML for modeling service processes from the end-user's perspective. CJML targets a wide and heterogeneous group of users, making it especially challenging regarding usability. This paper describes how an industry-relevant DSML was systematically improved by using a variety of user-centered design techniques in close collaboration with the target group and how their feedback was used to refine and evolve the syntax and semantics of CJML. We also suggest how a service-providing organization may benefit from adopting CJML as a unifying language for documentation purposes, compliance analysis, and service innovation. Finally, we generalize the experience gained into lessons learned and methodological guidelines.

We report on an evaluation of the Customer Journey Modelling Language (CJML) for documenting and visualizing a service process from the customer's perspective. The target group is employees in service organizations. We present a modelling toolkit and a scenario-based procedure that was used during the experiment with 48 target users. The purpose was to assess the applicability of CJML when introduced to new users. The participants were able to utilize CJML in a collaborative setting after a short training session. Overall, CJML was perceived as intuitive and useful by a large majority of the participants. A high precision level was obtained in more than 50% of the models produced during the experiment. Still, the analysis reveals the need for better guidance on delineation of process steps. We discuss validity of the results, and further work required to improve CJML.