Information security is an area that is becoming increasingly important for companies due to the growing number of cyberattacks, which result in significant financial losses for businesses. This threat places higher demands on employees to be aware of the risks and threats that the company faces. To prepare employees for these threats, companies need to implement measures that increase awareness and train employees on how to act when confronted with threats such as phishing mail, which is a challenge for SMEs.

The purpose of the study is to provide recommendations that can improve the implementation of awareness increasing measures. To achieve the study's purpose, factors affecting SMEs during the implementation of awareness increasing measures have been identified, as well as factors important for the successful implementation of new awareness-raising measures. A qualitative method was chosen to achieve the study's purpose, involving ten semi-structured interviews with IT personnel who have been involved in the implementation of awareness increasing measures. A thematic method was used to analyze the data, identifying themes based on the respondents' answers.

The empirical results show that several factors influence SMEs, including time, money, and management, which several respondents highlighted in the interviews. Additionally, six important factors have been identified for SMEs to succeed in implementing new awareness-raising measures. The study concludes with recommendations on the key factors SMEs need to work on to succeed in their implementation, as well as how these factors affect the companies. The study has focused only on SMEs in southern Sweden, without considering specific sectors.