# Despite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics
## 6 Discussion  
We extensively analysed and interpreted our results in Sections 4 and 5. This section will focus on a discussion of our research questions and the potential limitations of our research.  
Our first research question asked: How are cybersecurity metrics aggregated in socio-technical cybersecurity measurement solutions? One interesting finding from Table 8 is that half of the research involving implementations did not aggregate at all. Table 2 gives a partial explanation for this phenomenon: no aggregation strategy satisfies all desirable security properties. Thus, aggregation should preferably be avoided. Nevertheless,  
Figure 4: A visualisation of the framework presented in Table 10 using the representation of Figure 3.  
aggregation using basic approaches such as WLC is prevalent, with 42 of our 60 inclusions using this aggregation technique. We observed a clear lack of dependency consideration among metrics, which could be solved using Bayesian network [83; 84; 85; 86] or ANP techniques [50; 51]. Our cybersecurity framework presented in Table 10 provides clear guidance on which aggregation strategies suit which SME categories.  
Our second research question was formulated as: How do aggregation strategies differ in cybersecurity measurement solutions relevant to SMEs and all other solutions? Our analysis of Table 9 demonstrated that in enterprise research little to no attention is paid to aggregation strategies that satisfy the weakest link and dependency properties. One of the main obstacles in making aggregation strategies suitable for SMEs is the time and expertise required to carry them out. Generally, more complex aggregation strategies require the determination of more parameters and relationships, which in turn often requires consultation of security experts at the cyber-system being assessed (for example, [89; 102; 103; 104]). This expertise is rarely available at smaller SMEs, although when it is, ANP approaches [50; 51] could offer a path towards more accurate aggregation.  
Our final research question covered the consideration of adaptability: \"the state of being able to change to work or fit better\" [18]. We found that very few papers consider the effects of missing data, dirty data, security events, or concept drift; all are vital elements in determining the ability of a solution to adapt to unexpected circumstances to work better. Research does often recognise the need for being able to change to fit better, as shown by the relatively large proportion that considers adaptation to other use cases. Nevertheless, there is still much to be gained in this area. It is vital that authors of research on socio-technical cybersecurity measurement solutions explicitly address the adaptability dimension in the future. Our framework of Table 10 helps in this regard, with its focus on proactive processes and active monitoring and detection capabilities.  
We additionally analysed the ADKAR factors that were addressed in our inclusions. We found that desire was rarely considered in research. This was especially true for research focusing on the defender perspective. Additionally, we found that the real-life threat environment, as defined in [PERSON] et al. [22], is considered in less than half of our inclusions. Both of these findings offer an interesting contrast to the increasingly important role SDT and PMT play in security research [25]. These theories focus heavily on (intrinsic) motivation and threat perception [24]. Given the low intrinsic motivation among SMEs and their employees to improve security [3], and the relatively large impact individual employees can have in the SME context, future research focusing on motivation and the real-life threat environment could provide an interesting avenue for making cybersecurity solutions more suitable to SMEs.