2.1 Cybersecurity practices

2.2 The role of firm size and digital strategy in cybersecurity adoption

This study views firm size and digital strategy as organizational enablers that condition the adoption of cybersecurity practices across the three dimensions discussed in Section 2.1-organizational engagement, awareness/training, and vulnerability management. From an organization and management perspective (Bharadwaj et al., 2013; Tam et al., 2021), the integration of cybersecurity into everyday operations depends on how firms organize and align resources and routines around digital transformation priorities (Verhoef et al., 2021).

Concerning firm size, a consistent pattern reported in prior work is that cybersecurity maturity tends to increase with size, reflecting deeper resource endowments, access to specialized personnel, and stronger exposure to compliance pressures and supply-chain requirements (Hasan et al., 2021; Tam et al., 2021; Neri et al., 2024). Also, Dinkova et al. (2024) showed that SMEs invest less in cybersecurity than large businesses; however, SMEs do not report more cyber incidents, thus suggesting that these firms are not more vulnerable than their larger counterparts, which are usual targets of cyber-attacks (Hoong & Rezania, 2024). Translating this evidence to the adoption of cybersecurity practices, larger firms typically have greater financial resources, which enable them to invest in advanced technologies, systematize vulnerability assessment and testing, and dedicate resources to targeted training and cybersecurity teams (Friday et al., 2024; Chaudhuri et al., 2025).

By contrast, SMEs face resource and capability constraints (OECD, 2017; Eller et al., 2020; Clemente-Almendros et al., 2024) and sometimes attitudinal underestimation of cyber risks (Wilson et al., 2023), which can dilute the effects of any effort directed towards improving the firm's cybersecurity. But, it has also been found that SMEs can progress markedly when they leverage standardized frameworks and external guidance (Benz & Chatterjee, 2020), embed basic governance, and connect training to role clarity (James et al., 2013; Vroom & Von Solms, 2004).

From this body of literature it can be deduced that firm size influences technical investments and program implementation, as well as the organizational structures that govern cybersecurity plans and measures. Therefore, the following hypothesis is proposed:

H1: Firm size, in terms of employees, is positively correlated with the adoption of cybersecurity practices.

Besides firm size, a clearly articulated digital strategy operates as a managerial mechanism that allows firms to align cybersecurity with digitalization goals which, in turn, reduces coordination problems and fragmentation in decision-making, while facilitating the development of 'cybersecurity-by-design' actions and technology choices (Bharadwaj et al., 2013; Verhoef et al., 2021). Recent work underscores that cybersecurity maturity reflects not only technical controls, but also managerial choices about awareness, governance, and intra- and inter-firm coordination (Wong et al., 2022; Hoong & Rezania, 2024; Chaudhuri et al., 2025).

Firms with a digital strategy are in a better position to formalize information security policies and roles (Li et al., 2019) and invest in tailor-made training programs and response/recovery plans (Hasani et al., 2023; Wong et al., 2022), and incorporate vulnerability information into risk-based decision-making (Neri et al., 2024; Heiding et al., 2023). Implementation time also matters: longer-lived strategies typically enable cumulative learning and routinization, which support higher cybersecurity maturity (Hasan et al., 2021; Li et al., 2022). On contrary, without a formal digital strategy firms' cybersecurity will likely rely on tool-centric spending and weak protocols that lack the structured organizational support needed to translate cyber-controls into reliable routines (Vroom & Von Solms, 2004; Neri et al., 2024; OECD, 2024).

Therefore, a digital strategy acts as a strategic glue, a capability that helps to align human capabilities, technological tools, and organizational processes in a coherent cybersecurity framework, which facilitates the shift from treating cybersecurity as a purely technical safeguard to managing it as a strategic asset that supports competitive advantage (Porter & Heppelmann, 2014; Teece, 2018). Based on this body of literature we hypothesize:

H2: Firms with a formal digital strategy will demonstrate greater cybersecurity maturity.

3.1 Data

The data used for this study is based on a survey on digitalization and cyber risks. The survey characterizes the companies' use of different digital tools and the cybersecurity level for each firm according to the National Institute of Standards and Technology's (NIST) Cybersecurity Framework (CSF). The data was collected through an online structured questionnaire using LimeSurvey. The unit of analysis is the business, and the instrument was answered by the General Manager (CEO) or the person responsible for the company's information and communications technology (ICT).

Data was collected between September and November 2024. After removing observations with incomplete data, the final clean sample used for this study consists of 66 companies. The diversity of economic activity corroborates the validity of the final sample. Table 1 shows the breakdown by industry: manufacturing (20%), retail (43%), knowledge-intensive business services (KIBS) (17%), and other (agro-food and consumer-oriented services) (20%).

Additionally, a further inspection of the data reveals that SMEs-with less than 250 employees-represent 69.70% of the sampled firms (46 observations). Concerning the economic activity of the two sub-samples, a similar industry distribution was found: manufacturing SMEs= 20% (20% for large firms), SMEs in retail sectors= 48% (30% for large firms), KIBS SMEs= 15% (20% for large firms), and SMEs in other industries (agro-food and consumer-oriented services)= 17% (30% for large firms). The reported similarity in industry distribution across size categories suggests that the industry composition is unlikely to bias the comparison of cybersecurity practices between SMEs and large firms.

3.2 Variables

3.3 Method

The empirical strategy adopted to test the study's hypotheses is based on two complementary methods.

In the first stage, we employ a non-hierarchical cluster model (K-means) to evaluate firms' cybersecurity practices, using the variables in Panels A-C of Table 1 as inputs.

The non-hierarchical cluster analysis is based on the Euclidean distance between vectors of the standardized values of the studied variables (Anderberg, 1973; Everitt, 1980). Through this procedure observations-in our case, firms- are classified according to the similarities in the analyzed cybersecurity dimensions. The K-means cluster requires the establishment of a fixed number of clusters, which represents the main pitfall of this model because in many research fields (including social sciences) cluster analyses are often exploratory.

To corroborate the number of clusters and the validity of the proposed analysis, we used the Calinski and Harabasz (1974) statistic. This index is obtained as = where B(k) and W(k) are the between- and within-cluster sums of squares, with k clusters, respectively. Since B(k) > W(k), the largest CH(k) value indicates the best clustering. In this study, the number of clusters that maximizes the CH(k) index is 3 (pseudo-F value: 41.94). Therefore, the final non-hierarchical cluster asks for a three-way division. The full set of results of the CH(k) statistic computed in this study is presented in Appendix 1.

In the second stage, an ordered logit model is estimated to analyze the determinants of a firm's position within the cybersecurity maturity spectrum. In this model, the dependent variable is the ordinal cluster membership computed in the first stage (cybersecurity maturity levels: 'leaders'= 1, 'developers'= 2, and 'laggards'= 3). The independent variables include firm size (ln employees), a dummy variable accounting for the adoption of a digital strategy, implementation time of the digital strategy (ln years), and industry as control variable (agro-food and consumer-oriented services is the omitted industry category).

Given that the categories of cybersecurity maturity follow a hierarchical structure (i.e., an ordered discrete variable), the ordered logit model was chosen as econometric technique to formally test the study's hypotheses (Long, 1997).

The ordered logit model is an extension of the standard logistic regression applied when the dependent variable is categorical and has a meaningful order with more than two categories (Long, 1997; Greene, 2003). The ordinal logit model is estimated via maximum likelihood and can be expressed in terms of the probability of revealing a given cybersecurity maturity level as:

where j is cybersecurity maturity level, Xi is the vector of independent variables, ß is the vector of coefficients to be estimated that vary across the categories of the dependent variable, and ϕ _j . are cut-off points for the thresholds of the ordered model.

This approach provides a robust statistical test of whether firm size and the adoption of a digital strategy influence firms' cybersecurity maturity level, thereby directly addressing the second research question and reinforcing the theoretical link between organizational characteristics and cybersecurity adoption.

As for the study's hypotheses, we expect a positive result for the coefficients linked to firm size and digital strategy to confirm that size (in terms of employees) (H1) and the adoption of a digital strategy (H2) are positively correlated with the adoption of cybersecurity practices.

4.1 Cluster analysis: Identifying the level of cybersecurity maturity

This section presents the results of the cluster analysis aimed at identifying patterns of cybersecurity practices adopted by the analyzed Costa Rican firms. The cluster model yielded three clearly differentiated groups of firms based on their levels of cybersecurity practices: 'cybersecurity leaders', 'cybersecurity developers', and 'cybersecurity laggards'. These groups demonstrate marked differences in terms of their profile as well as the cyber-security practices evaluated (organizational cybersecurity engagement, awareness and training, vulnerability management). For each group, Table 2 shows the results for the profile variables while the main findings for the cybersecurity variables analyzed in this study are presented in Table 3.

The first group (n= 20), cybersecurity leaders, includes the most mature firms in terms of cybersecurity practices. These firms are, on average, the largest (673.75 employees) and oldest (42.05 years) in the sample, with 70% having adopted a digital strategy and an average time since implementation of 8.95 years, which can be interpreted as evidence of advanced digital maturity. Finally, this group includes the largest proportion of firms in knowledge-intensive business services (KIBS) activities (25%), thus suggesting a high alignment between their operational processes and cybersecurity practices (technology-strategy fit) (Table 2).

The findings in Table 3 indicate that this group shows the highest levels for the three analyzed cybersecurity dimensions. The results highlight the high organizational cybersecurity engagement among these firms (the variables with the highest scores are 'response plans', 'definition of information security roles and responsibilities', and 'cybersecurity roles and responsibilities in asset management'). These findings, in particular for the cybersecurity of asset management processes and response plans, are in line with prior work emphasizing the relevance of institutionalizing cybersecurity practices if the development of measures that safeguard business operations is the desired goal (e.g., Hasani et al., 2023; Friday et al., 2024).

In terms of cybersecurity awareness and training, these firms score uniformly high, with the exception of the variable linked to the 'definition of cybersecurity functions in human resources practices. This result reflects the strategic integration of technical and human dimensions of cybersecurity within firm operations (Wong et al., 2022). Among these firms, the approach to vulnerability management is also advanced, especially for the variables linked to the identification and assessment of cyber-threats ('Internal or external threats are assessed as they arise' and 'Potential threats, vulnerabilities, probabilities, and business impacts are identified to determine risk'). This implies that, in this group, cyber-risks are evaluated not just technically but also in terms of their potential operational and economic impact, which might contribute to firms' cyber-resilience (Neri et al., 2024).

The second group-cybersecurity developers-consists of 31 firms, with an average size of 335.32 employees and an average age of 28.26 years. Although for these firms digital strategy adoption is similar to that reported for Group 1 (71%), their implementation duration is shorter (6.77 years) (Table 2). These firms, mostly operating in retail and consumer-oriented services, demonstrate moderate cybersecurity maturity, reflecting ongoing development efforts.

Notice that in this group 'information security policies' and 'risk management processes' are the most important organizational cybersecurity engagement practices (Table 3). On contrary, 'defined cybersecurity roles and responsibilities' and 'response plans' are areas that need improvement. To sum up, these firms seem to be carrying out efforts towards the creation of structured cybersecurity governance (Chaudhuri et al., 2025; Hoong & Rezania, 2024).

Cybersecurity awareness and training efforts are unevenly distributed in this group. While response plans and staff role clarity are well structured in this group ('response and recovery plans are tested' and 'staff is aware of their roles and order of operation when a response is necessary'), employees' training and inclusion of cybersecurity functions in human resource practices are less consistent. These results suggest that awareness is a strategic concern in this group, but there is insufficient organizational support to drive behavioral change across the organization (Li et al., 2022). Their vulnerability to cyber-threats practices reflects a partial position. Whereas the identification of potential cyber vulnerabilities and their impact on the business is well identified, vulnerability testing is inconsistent, which might indicate that these firms acknowledge the value of recognizing cyber-risks, but the operationalization of protection strategies is not fully developed (Benz & Chatterjee, 2020) (Table 3).

The 15 firms included in the third group (cybersecurity laggards) are the smallest (72.33 employees) and youngest (20.73 years) in the sample. Also, these firms are in the early stage of the digital transformation process: only 33% have adopted a digital strategy, and the average implementation time is the lowest among the sampled firms (4.47 years) (Table 2).

Firms in this group consistently underperform in all the analyzed cybersecurity dimensions, signaling high vulnerability and low organizational readiness. In the case of the organizational cybersecurity engagement practices, firms in this group show extremely low levels of formalized practices and underdeveloped response planning. These results highlight structural weaknesses and echo concerns about the gaps in digitalization and cyber readiness among small, resource-constrained firms stressed in prior research (Lafuente et al., 2019; Benz & Chatterjee, 2020; Friday et al., 2024).

Concerning cybersecurity awareness and training, this group shows a poor integration of cybersecurity into human resource practices, while staff roles in cyber-incident response are poorly defined. This group lacks both a cybersecurity culture and investments in employee-centered cybersecurity (Wong et al., 2022). Finally, for the practices related to vulnerability to cyber-threats, results reveal that these firms are highly exposed to cyber incidents. The identification and documentation of cyber vulnerabilities, evaluation of the impacts of cyber-risks, and vulnerability testing are the weakest points in this group (Table 3). The lack of systematic threat identification and assessment leaves firms in this group particularly vulnerable to disruption (Hasan et al., 2021; Neri et al., 2024).

4.2 Ordered logit model: Hypotheses testing

To further investigate the role of firm size and digital strategy in explaining differences in cybersecurity maturity, we estimated an ordered logit regression using the ordinal cluster membership variable estimated from the first stage analysis as the dependent variable. Regression results and average marginal effects are presented in Table 4.

Prior to presenting the results, notice that the variance inflation factor (VIF) was computed to test whether coefficients are amplified due to correlations across the explanatory variables. The average VIF value for the full model in Table 4 is 2.36 (range = 1.55-4.19). The results of this diagnostic test suggest that the model specification does not suffer from collinearity problems, thus further validating our empirical approach (Greene, 2003).

The results show that firm size is positively and significantly associated with higher cybersecurity maturity: large firms are more likely to belong to the 'leaders' cluster, compared to SMEs, holding other factors constant. In terms of interpretation, notice that because size enters as a logged term in the model, proportional size changes translate linearly into probability changes. The result of the marginal effect for the variable size indicates that, holding other variables constant, a 50% increase in firm size (e.g., from 10 to 15 employees) rises the probability of being a cybersecurity 'leader' by 2.03 percentage points (). This significant result, together with the finding obtained for the 'laggard' group, leads to confirm our first hypothesis (H1) stating that firm size, in terms of employees, is positively correlated with the adoption of cybersecurity practices.

In the case of the digital strategy, the findings indicate that this variable has a positive effect on cybersecurity maturity level. Specifically, the results for the marginal effects in Table 4 suggest that the probability of being a cybersecurity 'leader' increases 27 percentage points for firms with a formal digital strategy, relative to the probability of firms that do not have a digital strategy. This finding reinforces the theoretical expectation that firms' strategic orientation (in terms of digital strategy) is a critical enabler of cybersecurity adoption, and confirms our hypothesis H2 which states that firms with a formal digital strategy will demonstrate greater cybersecurity maturity.

To sum up, by integrating the results of the cluster analysis with the ordered logit regression, we provide both an exploratory classification of firms' cybersecurity maturity levels and an analysis of how factors related to firms' structural capacity (size) and strategic orientation (digital strategy) influence firms' cybersecurity maturity levels.

5.1 Discussion

This study set out to examine how firm size and the adoption of a digital strategy influence the maturity of cybersecurity practices in Costa Rican SMEs and large firms. Guided by postulates from the strategic management literature and the capability perspective (Bharadwaj et al., 2013; Teece, 2018), our objective was to move beyond a purely technical framing of cybersecurity and assess how factors linked to firms' structural capacity (size) and strategic orientation (digital strategy) shape the adoption of cybersecurity practices. By combining an exploratory cluster model with an ordered logit model, we provide an integrated view of both the configuration of cybersecurity practices and the organizational determinants that underlie the reported patterns.

The analysis underscores the importance of a bundled, cross-dimensional approach to cybersecurity adoption. The three identified clusters-i.e., leaders, developers, and laggards-reveal that advanced cybersecurity maturity is not the product of isolated initiatives, but rather the coordinated deployment of organizational resources, the coordination of processes, employee awareness, and systematic vulnerability management (Hasan et al., 2021; Chaudhuri et al., 2025; Friday et al., 2024). This aligns with prior work emphasizing that organizational enablers condition the routinization of cybersecurity practices through the alignment of resources, processes, and managerial priorities (Bharadwaj et al., 2013; Verhoef et al., 2021).

Specifically, firm size emerges as a consistent factor that explains cybersecurity maturity, reflecting the logic that larger organizations possess greater capacity to invest in specialized personnel, monitoring tools, and formalized governance (Hasan et al., 2021; Tam et al., 2021; Neri et al., 2024). Yet the findings also challenge deterministic interpretations: some SMEs attain high maturity when a digital strategy is in place, suggesting that strategic orientation can compensate for resource limitations by providing strategic guidance and prioritization mechanisms (Wong et al., 2022). This interplay between size and strategy orientation, which we link to a relevant capability, highlight the importance of resource orchestration configure cybersecurity practices (Porter & Heppelmann, 2014).

Digital transformation is a process that requires significant efforts at all firm levels (Lafuente et al., 2018; Rojas-Segura et al., 2023; Escribá-Carda et al., 2024). The strong effect of adopting a formal digital strategy reinforces its role as a central managerial capability to organize assets (tangible and intangible) and coordinate internal processes (Mora-Esquivel and Leiva, 2025). Firms with such strategies are more likely to embed cybersecurity into broader digital transformation efforts (Verhoef et al., 2021; Chaudhuri et al., 2025) that, in turn, help to institutionalize cybersecurity practices that will likely be reinforced over time (Hasani et al., 2023; Li et al., 2019). The integration of cybersecurity within a firm's strategic architecture facilitates cyber-policy codification, role assignment, and the development of training programs that advance cyber-maturity (Hoong & Rezania, 2024; Wong et al., 2022). This is in line with recent work emphasizing that digital strategies serve as roadmaps for technology adoption, as well as governance mechanisms that align human, technical, and procedural elements in support of sustained performance (Bharadwaj et al., 2013; Porter & Heppelmann, 2014).

Taken together, the results presented in this study contribute to strategic management research by linking observable maturity patterns to underlying organizational enablers. They show that building robust cybersecurity practices is much more than a mere technological investment, but implies the alignment of the firm's strategic goals with operational execution in ways that reinforce intra-firm complementarities (Bharadwaj et al., 2013; Melville et al., 2004). This helps explain why fragmented, tool-centric approaches often fail to deliver effective cybersecurity plans, whereas integrated strategies boost firms along the maturity trajectory from low to high levels of cybersecurity maturity (Hasan et al., 2021; Chaudhuri et al., 2025; Friday et al., 2024).

5.2 Implications for academia

The results presented in this study have important implications for academia and practice. For cybersecurity research, prior work has called for more granular examinations of how organizational characteristics influence cybersecurity behaviors (Hasan et al., 2021; Hasani et al., 2023). Our identification of three distinct clusters-leaders, developers, and laggards- provides a refined framework that explains how cybersecurity practices co-evolve with organizational development and digital maturity. The resulting typology also supports the theoretical claim that the adoption of cybersecurity practices is not a path-dependent process shaped by strategic intent, resource availability, and organizational commitment (Chaudhuri et al., 2025; Hoong & Rezania, 2024). Related, this study advances an empirical typology of cybersecurity implementation within firms operating in a developing economy. Future work can build on these results to develop more holistic models that account for cross-dimensional enablers and inhibitors of cybersecurity adoption, especially in under-researched contexts.

Second, the study enriches the literature on socio-technical perspectives of cybersecurity by showing how human, organizational, and technological practices interact in shaping firm-level cybersecurity postures. The reported variations across cybersecurity awareness and training practices, especially the integration of cybersecurity into human resource processes, illustrate that technology-centric models might be insufficient to explain the effective integration of cybersecurity practices into business operations. These findings align with the growing body of research emphasizing managerial and governance dimensions of cybersecurity (Wong et al., 2022; James et al., 2013).

5.3 Implications for practitioners

For managers, the findings presented in this study provide a practical roadmap for benchmarking cybersecurity policies. The differentiation between cybersecurity leaders, developers, and laggards offers the opportunity for firms to self-assess their cybersecurity position and identify concrete gaps in their practices. For example, managers of firms catalogued as cybersecurity laggards will be well advised to prioritize investments in key areas, such as information security policies and vulnerability identification and response planning, while firms in the cybersecurity developers group might benefit from developing cybersecurity awareness programs and vulnerability testing. Related, a step-wise process to cybersecurity might enable resource-constrained firms to progress incrementally in their cybersecurity maturity based on their capabilities and specific needs.

Second, the results highlight the importance of embedding cybersecurity into broader digital transformation strategies. The group of cybersecurity leaders is characterized by having a more consolidated digital strategy, which suggests that cybersecurity implementation is a strategic process that should match technical issues with organizational processes. As digital technologies are increasingly integrated into operations, firms must treat cybersecurity as a key business function. Industry chambers can use these insights to develop tailored support programs and training initiatives that facilitate structured cybersecurity developments across firms operating in different sectors. Promoting inter-firm collaboration and knowledge-sharing, especially in sectors with limited digital maturity, could also accelerate cybersecurity-capability building at the territorial level (Lafuente et al., 2022).

6.1 Conclusion

This study investigated the cybersecurity maturity level of Costa Rican firms, focusing on shared patterns and challenges in the context of ongoing digital transformation processes. Through a cluster analysis, we identified three distinct groups of firms, in terms of the adoption of cybersecurity practices: leaders, developers, and laggards. These groups show marked discrepancies in their cybersecurity maturity across three analyzed dimensions of cyber-practices (organizational cybersecurity engagement, cybersecurity awareness and training, and vulnerability to cyber-threats).

The findings reveal that a small proportion of firms demonstrate high cybersecurity maturity, while the majority are either in the process of developing practices or remain significantly underprepared. Firms in the cybersecurity leaders group show a comprehensive, institutionalized approach to cybersecurity, whereas cybersecurity developers show partial engagement and inconsistencies, and laggards lack foundational cybersecurity structures. These findings highlight both the uneven implementation of cybersecurity practices among Costa Rican firms and the presence of critical gaps that might hinder secure digitalization processes.

6.2 Future research

This study opens various avenues for future research. First, future work should take a longitudinal approach to analyze how firms transition towards high cybersecurity maturity levels over time. Despite the relevance of the findings presented in this research, the cross-sectional approach of this study cannot capture the dynamics of cybersecurity implementation and adaptation. Future work should also explore how relevant organizational factors related to managers' leadership, organizational culture, or supply chain integration (Friday et al., 2024) influence firms' progression from low to high levels of cybersecurity implementation.

Second, specifically designed future research should evaluate the link between cybersecurity practices and performance metrics to establish whether and how certain cybersecurity practices have the potential to produce greater organizational resilience or improve operational or economic outcomes. Such studies can also explore potential moderating variables such as organizational culture, technological complexity, or supply chain integration (Lafuente et al., 2010; Friday et al., 2024). Third, further qualitative research is needed to increase our understanding of the barriers and enablers of cybersecurity adoption in small and large firms. The role of potential internal drivers (e.g., managerial knowledge, employee resistance) and external pressures (e.g., supply chain requirements, customer demands) can be included in such analysis.

Finally, this study focused on Costa Rican firms, and more studies across other developing and developed settings should be conducted to determine the generalizability of the findings and patterns observed in this study.

1

BBC News: https://www.bbc.com/storyworks/procomer-essential-costa-rica/why-costa-rica-is-becoming-a-prime-destination-for-multinational-companies?utm_source=BBC-ROS&utm_ medium=traffic-driver-halfpage&utm_campaign=EssentialCostaRica&utm_content=article1 PR Newswire: https://www.prnewswire.com/news-releases/cinde-costa-rica-launches-new-digital-investor-experience-in-line-with-industry-4-0--301268136.html