Cybersecurity decision-making in ethnic minority-owned small businesses: Refining a socio-cultural framework through qualitative evidence

Abstract

Small and medium-sized enterprises (SMEs) face growing cybersecurity threats, yet existing research often overlooks the socio-cultural dynamics shaping decision-making, particularly in ethnic minority-owned businesses. This study examines how individual capabilities, social relationships, and contextual or cultural factors interact to influence cybersecurity behavior in these SMEs. The study draws on 20 semi-structured interviews with minority SME owners in Québec and applies an inductive thematic analysis to explore how cybersecurity decisions emerge from everyday business practices and experiences. The findings identify three interrelated domains that shape cybersecurity behavior: individual factors, including prior experience, digital literacy, and perceived risk; social factors, such as trust, community networks, and peer influence; and contextual or cultural factors, including language barriers, cultural norms, and access to institutional support. Building on these insights, the study proposes a refined socio-cultural framework that highlights the iterative, experience-driven, and socially embedded nature of cybersecurity decision-making in minority-owned SMEs. The findings also reveal that informal community networks can simultaneously facilitate learning and unintentionally normalize cybersecurity risks. These results suggest that cybersecurity interventions should move beyond purely technical or resource-based approaches and instead incorporate culturally sensitive, socially grounded, and context-aware strategies. Policymakers and support organizations should therefore design outreach programs, training initiatives, and advisory services that leverage trusted community networks and improve institutional accessibility for diverse entrepreneurs navigating digital risks.