How Scenario-Based Interventions Transform Cybersecurity Mental Models in Danish Defence SMEs
TL;DR
A two-phase study that traces the transformation of mental models among stakeholders in Denmark’s defence supply chain shows that scenarios catalyzed significant shifts, such as from reactive to proactive mindsets and from isolated to supply-chain-wide perspectives.
Abstract
When stakeholders in the national cybersecurity landscape hold fundamentally different mental models of cybersecurity, even well-designed policies can fail to be implemented in practice. We present a two-phase study that traces the transformation of mental models among stakeholders in Denmark’s defence supply chain. First, we conducted workshops with policymakers (n=6) and policy promoters (n=11) to develop five scenarios and elicit their perceptions of cybersecurity for Small and Medium Enterprises (SME). Then, policy implementers from 12 SMEs (n=28) were confronted with the scenarios. We elicited mental models before and after to assess scenario-driven change. Our findings show that scenarios catalyzed significant shifts, such as from reactive to proactive mindsets and from isolated to supply-chain-wide perspectives. However, deeper structural dimensions, e.g., the framing of cybersecurity as a cost rather than an investment, proved resistant to change. Based on our results, we outline design implications for stakeholder-adaptive cybersecurity interventions in high-trust cultural contexts.