Understanding cybersecurity learning adoption among SMEs: Evidence from Indonesia through the TOE-I framework

Digitalization brings small and medium-sized enterprises (SMEs) both opportunity and heightened cybersecurity risk, especially in developing countries such as Indonesia, where a fast-growing digital economy meets low cybersecurity maturity. This study examines what drives intention to adopt cybersecurity learning among Indonesian SMEs, using the technology–organization–environment–individual (TOE-I) framework and survey data from 242 SME practitioners. Relative advantage and cybersecurity awareness positively predicted adoption intention; complexity and external pressure did not. Owner/manager innovativeness, organizational readiness, and resource constraints significantly shaped cybersecurity posture, but owner/manager support did not. An exploratory test, not hypothesized a priori, found that cybersecurity posture does not significantly predict adoption intention, pointing to a gap between an SME’s security condition and its willingness to invest in learning. These results extend the TOE-I framework to a developing-country SME context and suggest that perceived benefit and cybersecurity awareness, more than posture or external pressure, are what move security education, training, and awareness (SETA) programs forward.