What micro-businesses need: a user-centered approach to cybersecurity support

Micro-businesses are disproportionately exposed to cyber threats yet remain underserved by generic ‘one size fits all’ cybersecurity guidance that often fails to reflect their resource constraints and operational realities. To address this research-practice gap, this study adopts a user-centered design (UCD) approach to synthesise and articulate the cybersecurity needs of UK micro-businesses. Thirty semi-structured interviews were conducted across three subgroups: Digitally Dependent, Digitally Based, and Digital Enablers. Thematic analysis generated 36 user needs, expressed using the UK Government Digital Service (GDS) format and organised into four categories: Guidance, Posture, Resources, and Return on Investment (ROI). Guidance needs were most prominent, highlighting demand for actionable, simple, tailored, and trustworthy support that reaches businesses proactively, avoiding fear appeals. While resource constraints were universal, subgroup differences emerged particularly in ROI and regulatory awareness, underscoring the limitations of homogeneous SME engagement strategies. Rather than offering new findings on barriers to adoption or proposing empirically validated interventions, the study contributes a structured, user-needs-led benchmark and a literature-informed ‘opportunity space’ for designing more contextually aligned cybersecurity support. Overall, the findings suggest that improving SME cybersecurity engagement may depend less on generating new knowledge and more on translating existing insights into accessible, actionable, and user-aligned forms of support.