A Grounded Theory of SME Resilience in Network Information Security

South African small and medium-sized enterprises (SMEs) play a critical role in national economic growth by driving employment creation and innovation. Many SMEs, however, lack the resources, expertise, and governance structures needed to implement robust network security systems. This leaves them increasingly vulnerable to cyber threats. Existing information security frameworks often fail to capture the contextual realities of these SMEs, where constraints, such as limited budgets, skill shortages, and infrastructural challenges, continue to complicate their information security adoption. To provide insights to these SME challenges, this study developed a substantive theoretical model known as the Theory of Information Security Resilience for SME Network Infrastructure (TISRI) using a grounded theory (GT) approach. Data was collected through in-depth interviews with SME information security practitioners selected through theoretical sampling until theoretical saturation of eight participants. Theoretical sampling used in GT research was used to select these eight participants. This methodological criterion prioritised the conceptual depth that these eight participants provided ove