## 6 Interview Results and Defined Research Questions
### Proportion of Free and Full-Featured Protection Solutions  
* RQ2: Do all companies have a software security solution, and if so, is this a free version with limited features, or have commercially installed subscription-based, full-featured solutions on their devices? All of the surveyed companies carry out online activities: advertising their own activities, operating a webshop, online banking, online invoicing, among other electronic administration tasks. Nevertheless, 79% do not have a firewall, 91% use a software antivirus solution, and 80% have installed free antivirus software on their IT system. Among the respondents, 91% had previously been victim of a virus attack and 48% had also been the victim of a ransomware attack. Following the attacks, 39% of companies did not change their previous hardware or software protection, however, 76% said they would be willing to implement a cost-effective, complex IT security system at their company. Figure 7 illustrates the comparison of the aforementioned data. Figure 6: Number of employees at the examined companies. Closely related to question RQ2 is the following research question. * RQ3: What is the role of the IT decision maker in the selection of the virus protection solution and what relation does this have with their level of existing professional qualification in the field of IT? In examining the IT skills of decision makers, the authors sought answers to the contexts that, in the presence or absence of IT skills, appear as an impact through decision making with the presence or absence of applied security solutions. The results obtained by examining the relationship in question are also illustrated in Figure 8. The next study was the number of virus attacks suffered and the virus protection solution available in the year preceding the interview. The result of this is shown in Figure 9.  
Figure 8: Present AV solutions in companies related to the decision makers IT grade. Figure 7: Vulnerability characteristics of examined companies. Only five of the companies surveyed had a professional, commercial virus protection solution installed on the system, and although a large number, 42 out of 46, were already victims of a virus attack, only four companies made changes to the IT system to increase security. A large amount of data was gathered during the interviews, and of course, the evaluation is not limited to the above questions. The main purpose of this manuscript was to present an improved, model-based ransomware protection system; therefore, from the results of the interviews, only the closely related criteria supporting the development and justifying the general need are discussed below. Willingness to Accept a Cost-Effective IT Security Solution for the Small- and Medium-Sized Enterprises Surveyed  
The primary purpose of a ransomware protection system is to thwart a ransomware attack. In addition to the available protection solutions, the questions of the interviews focused on whether the interviewed companies had fallen victim to any virus attack, ransomware attack, and if so, how this was handled, and how it affected the company's business and operations. Based on these, the following research question was formulated:  
* RQ4: What is the willingness of micro-, small- and medium-sized enterprises to adopt a solution that greatly automates and elevates the protection of IT infrastructure in the company's system, even without special expertise? Among the companies surveyed, 91% were already victims of a virus attack, and the rate was very high, 48%, for those who were already victims of a ransomware attack. Barely 20% of companies that have suffered a ransomware attack have taken steps to ensure a higher level of security for their IT system after the attack.