The power of interpretation

Cybersecurity is a hot topic and researchers have published extensively on studies conducted using a variety of different research methods. This paper aims to determine which qualitative research methods were most used and for studying which topics. A systematic literature review on Web of Science, Scopus and ACM DL has been conducted to achieve an overview of quantitative methods used in cybersecurity. The review covered the most recent research in different areas of cybersecurity (i.e., personal, organizational and state cybersecurity) in the period of 2017 to 2019. After careful inspection of papers, we identified 160 papers reporting on the use of qualitative methods. The most common qualitative methods are interviews, followed by case studies and observation. Other studied qualitative methods (i.e., focus groups, grounded theory, action research and Delphi method) seem to be much less frequent. Although qualitative methods are used when studying all key cybersecurity areas, they often lack the necessary rigor and detail observed in other research areas where qualitative methods are well-established.