## 9 Results  
As detailed in Section 6, the survey of SMEs provided important information on their current IT security situation. In the course of the survey, we mainly answered questions that show the existing information protection strategy in the companies, and in comparison with this, we focused on the events of the virus attacks and extortion virus attacks that have already taken place. The number of employees in the enterprises was one of the analyzed data. Among the examined SMEs, on the one hand, the number of employees was limited in terms of the SME classification of a company, and on the other hand, we received information on the proportion of employees who handled the company's data to be protected in terms of IT security (data ensuring the business continuity of the enterprise, data forming the basis of data provision related to business activities, personal data). The headcount data were categorized into four groups, which are characteristic of the size of the SMEs studied. Table 2 also shows numerically summarized data on how many of the responding companies belong to each size category. The second row of the table shows the number of cases in which the majority of employees have access to the data to be protected by companies during their daily work. The vast majority of the surveyed companies employ 2-10 employees, which was typical of 30 companies. The number of companies with one employee is also low in proportion, which means three companies out of the respondents. In comparison, in one-third of the enterprises, a maximum of one employee has access to the company data to be protected, whilst in the case of 30 companies, 2-10 people, and in one case, more than 10 employees have access to the data to be protected. A characteristic issue for the activities of enterprises in the survey was to examine how many of the companies have foreign business partners and how many enterprises have foreign sites. According to Table 3, only three of the 46 surveyed companies have a foreign location, but 21 of the surveyed companies have foreign business partners, as it can be seen in Figure 13. This issue is an interesting achievement in terms of communication on the Internet, electronic administration, and the remote availability of the company's data to be protected. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**One Person Business**} & \multicolumn{2}{c}{**Number of Employees**} & \multicolumn{2}{c}{**Number of Employees**} & \multicolumn{2}{c}{**Number of Employees**} \\  & **between 2 and 10 People** & **between 11 and 250 People** & **over 250 People** \\ \hline
**Number of companies** & 3 & 20 & 22 & 1 \\ \hline
**Employees working with sensitive data** & 15 & 30 & 1 & NA \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Number of companies/employees with access to sensitive data. The next result that the studies show is that 35 of the businesses allow home office work (Case A in Table 4). In 16 of these 35 companies, the use of a corporate email account is not regulated, and private use is also allowed (Case B in Table 4). Of the 35 companies mentioned, 17 have been victims of a recent ransomware attack (Case C in Table 4). Among the victimized businesses, there were 11 businesses where the use of a corporate email for private purposes was allowed along with the home office option (Case D in Table 4). These discovered relationships are illustrated in Table 4 and in Figure 14.  
The cases examined:  
* Case A: Home office enabled for employees,
* Case B: If home office is enabled, corporate email can be used for private purposes,
* Case C: In case home office is enabled, the company is a victim of ransomware attack,
* Case D: In the case where home office is enabled AND corporate email can be used for private purposes, the company is a victim of ransomware attack.