# Despite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics
## 4 Results
We additionally see that most research sticks to WLC and WP strategies, which do not satisfy the weakest link principle and cannot take into account dependencies. Researchers prefer simple and explainable strategies, which are injective or idempotent, over strategies that satisfy more security properties. Out of our 60 inclusions, 10 used fuzzy logic approaches. Although translating qualitative statements to fuzzy numbers differentiates these methods from approaches using crisp numbers, most still used some combination of WLC, WP, and WM to aggregate (for example, [80; 81; 82]). Exceptions are [PERSON] and [PERSON] [50] and [PERSON] et al. [51], who used an ANP approach to capture dependencies. [PERSON] and [PERSON] [50], [PERSON] et al. [51] and the four papers using a bayesian network approach [83; 84; 85; 86] are the only papers that considered dependencies between metrics. Interestingly, all of these papers were published in 2016 or earlier. It is not immediately clear what the underlying reason is for the current drought in research considering dependencies, but it is certainly a research area that deserves more attention. Table 9 provides detailed results regarding the research application area. Although more enterprise sizes were considered, we only encountered research applicable to medium- and large-sized enterprises, and research applicable to any enterprise size. As with research focused on maturity modelling, we see a strong focus on the reinforcement factor of ADKAR in enterprise research, especially for larger enterprises. In research intended to apply to any enterprise, Table 9 shows that WLC was by far the most popular aggregation strategy class. The only other strategy class that was used is WM. We believe it is not a coincidence that these are the only aggregation strategy classes that are both injective and idempotent. Strategies with these properties are likely to be more intuitive and easy to understand, as explained in Section 2.3. Therefore, it is not surprising that these strategies are proposed in research addressing all enterprise sizes, since especially smaller businesses need to be motivated through approachable solutions. \begin{table}
\begin{tabular}{l c c c} \hline \hline \multirow{2}{*}{**Aggregation Strategy**} & \multicolumn{3}{c}{**Classification**} \\  & **Theoretical** & **Implementation** & **Review** \\ \hline WLC & 38 & 1 & 3 \\ WP & 11 & 0 & 0 \\ WM & 8 & 1 & 0 \\ WCP & 1 & 0 & 0 \\ BN & 4 & 0 & 0 \\ \hline None & 7 & 2 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Different aggregation strategy classes and the situations in which they were employed. \begin{table}
\begin{tabular}{l l c c c} \hline \hline \multirow{2}{*}{**Property**} & \multirow{2}{*}{**Values**} & \multicolumn{3}{c}{**Application Area**} \\  & & **Any Enterprise** & **M/L Enterprise** & **Other** \\ \hline \multirow{4}{*}{ADKAR} & AW & 9 & 6 & 20 \\  & DE & 3 & 1 & 10 \\ \cline{1-1}  & KN & 7 & 2 & 10 \\ \cline{1-1}  & AB & 6 & 3 & 16 \\ \cline{1-1}  & RE & 11 & 13 & 15 \\ \hline \multirow{4}{*}{Aggregation} & WLC & 13 & 7 & 22 \\ \cline{1-1}  & WP & 0 & 3 & 8 \\ \cline{1-1}  & WM & 2 & 2 & 5 \\ \cline{1-1}  & WCP & 0 & 0 & 1 \\ \cline{1-1}  & BN & 0 & 1 & 3 \\ \cline{1-1}  & None & 1 & 4 & 5 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: ADKAR and aggregation strategy frequencies of enterprise research and other research. Regarding adaptability, of the 56 inclusions that were not review papers, 44 did not make any consideration for missing or dirty data. Of the papers that did consider one or both of these issues, the most common strategy was to ignore the associated problems. Out of these 56 papers, 46 were not able to adapt to a security event occurring, mostly since they did not operate in a live setting, but were formulated as periodic assessments. Even then, most authors did not cover this topic, and it is certainly not always clear how the security assessment would be adapted after an incident. Concept drift and adaptation to other use cases were also often not considered.