I find arrogance in SME's to be a big barrier...not only for Cyber Security but pretty much anything.
I did some work on a charity website recently. I wont name names here. The project was dooned tobfail as the Operations Director...a hard nosed bitch who is also an activist and a hard line feminist...couldn't grasp that what she was asking me to do was either technically impossible on their £6 a month hosting or highly retarded.
I got a lecture about their on house design expertise and her long standing experience in the industry.
I did some digging and found out that she has only ever worked at this charity and started there when she was in her early 20s. She is now in her late 20s.
A liability to be sure. The lecture she gave me was hilarious...I personally have web design experience going back to 1994...ive been through everything...seen all the trends...etc...you guys are probably the same...anyway Ibwas first told "we know whatvwe're doing we've been on a training course" and "it must be you the images we're sending look fine to us".
To clarify Ibwas asking for images 720 pixels by 120 pixels at 72dpi saved as PNG files. Or something to that effect.
I was getting either raw uncompressed and uncropped photographs or farting little GIFs about 10% of the size I needed.
I couldnt crop the images fornthem as they didnt want me to have any creative control.
I have an email chain the length of Linford Christies cock repeating my requirements over and over as well as explaining why the images they sent me were wrong.
This is not an isolated incident. A lot of Small Business directors get confused between "the vision" and "the business".
Once you've launched and are turning over some dough you need to reflect on your original idea and adapt according to the new facts you have learnt about your market. If you blindly follow "the vision" without wavering even slightly you will fail.
Bottom line, SMEs are generally chock full of arrogant self angrandising wankers who think they know better.