SMEs Do Not Adopt Cyber Risk Management: Evaluating Voice-Based Conversational AI as a Barrier-Reduction Solution

McGahan, Cathal (2025) SMEs Do Not Adopt Cyber Risk Management: Evaluating Voice-Based Conversational AI as a Barrier-Reduction Solution. Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (944kB) | Preview
Preview	PDF (Configuration Manual) Download (1MB) | Preview

Abstract

SMEs experience cyber-attacks at high rates (43% annually) yet only 25% adopt risk management frameworks (n=16 survey). This research investigated whether voice-based conversational AI could reduce technological adoption barriers whilst maintaining acceptable accuracy within existing organizational constraints.

Mixed methods combined exploratory survey (n=16 SME owners, 7 industries) with technical evaluation of a voice-based system guiding users through CISRAM IG1 assessment via natural dialogue. Survey validated five documented barriers (time, cost, complexity, expertise, awareness) whilst revealing non-adoption stems from competing priorities rather than awareness gaps. Technical evaluation compared AI-assisted completion against manual baseline across time, cost, and accuracy dimensions, testing two model sizes (20B vs 120B parameters).

Results demonstrated substantial barrier reduction. 24-fold time improvement (13 minutes vs 4-6 hours), 200-fold cost reduction (€1 vs €200-250), and eliminated expertise prerequisites. The 120B model achieved 87% accuracy with 6% mean absolute deviation, validating technical feasibility. Findings revealed system architecture determines performance more than computational scale (3-fold accuracy advantage over unstructured approaches), and that LLM evaluation requires multiple validation runs rather than single-test metrics. However, technological barriers must be reduced to thresholds enabling coexistence with competing priorities: 78% of non-adopters expressed willingness to adopt tools requiring under one hour, validating that barrier reduction to sufficiently low levels enables adoption within existing organizational constraints rather than requiring priority reordering.

Item Type:	Thesis (Masters)
Supervisors:	Name Email Pantridge, Michael UNSPECIFIED
Uncontrolled Keywords:	SME cybersecurity; cyber risk management; adoption barriers; non-adoption; conversational AI; voice interface; accessibility; organizational constraints
Subjects:	H Social Sciences > HD Industries. Land use. Labor > HD61 Risk Management Q Science > QH Natural history > QH301 Biology > Methods of research. Technique. Experimental biology > Data processing. Bioinformatics > Artificial intelligence Q Science > Q Science (General) > Self-organizing systems. Conscious automata > Artificial intelligence Q Science > QA Mathematics > Computer software > Computer Security T Technology > T Technology (General) > Information Technology > Computer software > Computer Security H Social Sciences > HD Industries. Land use. Labor > Small Business Sector
Divisions:	School of Computing > Master of Science in Cyber Security
Depositing User:	Ciara O'Brien
Date Deposited:	03 Sep 2026 11:44
Last Modified:	03 Sep 2026 11:44
URI:	https://norma.ncirl.ie/id/eprint/9807

Actions (login required)

View Item