AI-powered cybersecurity solutions boost SME readiness for Industry 5.0

The study begins by outlining the critical vulnerabilities plaguing Welsh SMEs as they embrace digital transformation. SMEs, despite forming the backbone of the regional economy, remain disproportionately vulnerable to cyber threats due to constrained financial resources, limited technical expertise, and fragmented cybersecurity awareness. Unlike large corporations, which can invest heavily in cybersecurity infrastructure, SMEs often lack the capacity to implement and maintain robust defenses.

Small and medium-sized enterprises (SMEs) are poised for a cybersecurity revolution as digital transformation accelerates, thanks to a new framework aimed at enhancing resilience against cyber threats. A comprehensive study titled "Cybersecurity Framework: Addressing Resiliency in Welsh SMEs for Digital Transformation and Industry 5.0," published in the Journal of Cybersecurity and Privacy, offers a detailed roadmap for SMEs across Wales to bolster cybersecurity capabilities.

The research, led by experts from the Cyber Wales Academy, CQ University Australia, and Teesside University London, presents an evolved model that combines tailored cybersecurity education with real-time AI-powered risk assessment. Drawing on an extensive mixed-methods analysis, the study integrates survey data from over 190 SMEs and interviews with key stakeholders to identify critical knowledge gaps, barriers, and opportunities for SMEs entering the Industry 5.0 era.

What challenges do Welsh SMEs face in achieving cyber resilience?

The study begins by outlining the critical vulnerabilities plaguing Welsh SMEs as they embrace digital transformation. SMEs, despite forming the backbone of the regional economy, remain disproportionately vulnerable to cyber threats due to constrained financial resources, limited technical expertise, and fragmented cybersecurity awareness. Unlike large corporations, which can invest heavily in cybersecurity infrastructure, SMEs often lack the capacity to implement and maintain robust defenses.

Systematic literature reviews and quantitative survey data revealed that while awareness of threats like phishing, ransomware, and malware is relatively high, in-depth knowledge of defense mechanisms remains alarmingly superficial. Many SME owners underestimate the potential business impact of a cyberattack, perceiving cybersecurity as a secondary concern compared to immediate operational pressures. This misplaced priority often results in inadequate investment in security measures, exacerbating vulnerabilities.

Resource constraints further complicate cybersecurity adoption. SMEs operate on tight budgets, leaving little room for cybersecurity investments or hiring specialized personnel. Technical complexity acts as another deterrent, with many business owners finding cybersecurity measures overly complicated and inaccessible. Moreover, evolving cyber threats, such as AI-driven attacks and sophisticated social engineering tactics, outpace traditional defense mechanisms, leaving SMEs dangerously exposed.

Adding to these difficulties is the knowledge gap surrounding the use of machine learning (ML) and AI in cybersecurity. Although AI promises to automate and enhance threat detection, most SMEs lack the technical expertise to implement such solutions. Financial constraints and aggressive vendor practices selling costly ML-based systems only widen this adoption gap.

How does the enhanced ROHAN model and Cyber Guardian Framework address these challenges?

To tackle these multifaceted challenges, the study introduces a dual-framework solution: the enhanced ROHAN model integrated with the newly developed Cyber Guardian Framework (CGF). The ROHAN model, an acronym for Readiness, Ongoing Awareness, Holistic Approach, Affordability, and Network Security, provides a structured, step-by-step roadmap for SMEs to achieve cybersecurity maturity.

In the Readiness phase, SMEs conduct vulnerability assessments and establish clear cybersecurity policies. Ongoing Awareness emphasizes continuous employee training through gamified microlearning modules. The Holistic Approach mandates integrating cybersecurity considerations across all business functions, from IT to HR and finance. Affordability ensures that SMEs leverage cost-effective solutions, including open-source tools and government-supported programs, while Network Security prioritizes the implementation of basic but critical protections like firewalls and two-factor authentication.

Complementing the ROHAN model, the Cyber Guardian Framework operationalizes training delivery using accessibility-focused design. The CGF offers microlearning modules, gamified engagement tools, and actionable cybersecurity practices tailored for non-technical staff. Five specialized “Cyber Guardians”, Shield, Firewall, Backup, Watchtower, and Collaboration Guardians, cover different aspects of cybersecurity education, from basic threat identification to collaborative threat response.

This integration ensures that cybersecurity is not a one-time checklist but an evolving organizational culture. Importantly, the CGF’s emphasis on explainable AI tools allows SMEs to benefit from real-time risk assessment without needing deep technical knowledge, effectively bridging the gap between advanced technology and everyday business operations.

What are the broader implications for digital transformation and Industry 5.0?

The research situates these frameworks within the broader context of Industry 5.0, where human-centric technology integration is central. Industry 5.0 demands cybersecurity systems that not only protect digital assets but also foster trust, collaboration, and sustainability between human and machine actors.

Compared to conventional cybersecurity frameworks like NIST or ISO 27001, which are often too resource-intensive for SMEs, the ROHAN model and CGF provide an adaptable, modular, and accessible alternative. This SME-focused approach ensures that businesses of all sizes can participate securely in digital ecosystems without being marginalized by technological complexity or financial barriers.

Furthermore, by embedding AI and ML into daily cybersecurity operations, SMEs can proactively detect emerging threats and respond swiftly, rather than relying on outdated, reactive measures. The frameworks also encourage participation in broader national cybersecurity initiatives, such as the Welsh Government’s Cyber Action Plan, offering SMEs the opportunity to gain formal recognition for achieving "Cyber Green" status.

Cybersecurity resilience for SMEs must be an ongoing, collaborative effort involving government support, industry partnerships, continuous employee education, and adaptive technology adoption, the study concludes.