Perception is not assurance: What validated assessments reveal about SME cyber security

Small and medium sized enterprises (SMEs) underpin the Australian economy and national supply chains, yet cybers ecurity decision making across this sector is still largely driven by self-reported confidence rather than validated assurance. This creates a critical governance blind spot, not only for SMEs themselves, but for boards, executives, service providers, insurers, and regulators who rely on those assurances.

This presentation draws on a multi-year PhD research journey that deliberately moved from perception to evidence. Early findings highlighted that most academic and industry research into SME cyber security relied heavily on qualitative methods and self-reporting. In response, a quantitative study was conducted in 2024 to examine how SMEs perceive their cyber security posture. While awareness appeared high, confidence levels often exceeded clarity about responsibility, standards, and accountability.

Recognising the limitations of self-assessment, including optimism bias, social desirability effects, and limited technical understanding, the research was extended further using a mixed method, multiple case study approach. Independent expert assessments were conducted across real SME operating environments, incorporating site visits, executive and staff interviews, technical vulnerability scanning, and documentation and artefact reviews.

Through triangulated scoring and gap analysis, SMEs’ self-reported claims were compared directly with observed operational reality and benchmarked against the NIST Cyber Security Framework (CSF). The results were consistent and concerning. SMEs significantly overstated their cyber security maturity, frequently confusing basic IT support services with specialised cyber security capabilities. Responsibility for cyber risk was often implicitly assumed to sit with IT service providers, while accountability legally and operationally remained with the organisation without any independent validation.

The findings demonstrate that self-assessment alone is unreliable as a governance mechanism. Without validation, boards and executives are left making decisions based on perception rather than evidence, exposing organisations and supply chains to hidden and systemic risk.

To address this gap, the research introduces the Validated Cybersecurity Posture Assessment Framework (VCPAF). VCPAF combines self-assessment with independent expert validation to provide a more accurate, context aware view of cyber security posture. Importantly, it reframes cyber security maturity as a governance and accountability challenge, rather than a purely technical one.

Aligned with the CyberCon 2026 theme Empowered Together, this talk argues that sustainable cyber resilience requires collective action. Clear ownership of cyber risk, transparent service relationships, standardised terminology, contractual clarity, and independent validation are essential to building trust across ecosystems.

At an industry and policy level, the presentation advocates for state and national SME cyber security validation programs, clearer sector specific standards, transparency reforms in digital service provision, and well-defined obligations for service provider SMEs.

Attendees will leave with evidence-based insights into why cyber security governance fails, what validated assurance looks like in practice, and how organisations can move from perceived maturity to accountable, resilient cyber governance together.