Structured classification of information security threats considering the industry specifics of small enterprises

The article is dedicated to the study of information security threats characteristic of small enterprises across various sectors of the economy. The subject of the research is the patterns of differentiation in the landscape of cyber threats depending on the sectoral affiliation of small business entities, as well as the possibilities for systematizing these threats within a unified classification model. The object of the study is the information security of small enterprises in various sectors of the economy. The author examines aspects such as the formation of a multidimensional classification model that integrates the sectoral characteristics of targeted assets with universal threat characteristics. Special attention is given to the resource constraints of small businesses, which significantly affect their ability to counteract cyberattacks. The issue of the high vulnerability of small enterprises is discussed. The characteristics of targeted assets are analyzed depending on the company's area of activity. The methodological basis of the study is a systemic approach. Methods of comparative analysis of existing threat taxonomies, analysis of industry reports on cybersecurity for 2024–2025, as well as classification modeling methods are applied. The novelty of the study lies in the development of a four-dimensional classification model of information security threats, which for the first time combines the sectoral differentiation of targeted assets with universal classification features. A significant contribution of the author to the research topic is the adaptation of the classification model to the specific conditions of small business entities, unlike existing taxonomies that are primarily oriented towards large organizations and critical infrastructure. The proposed model is structured along four interrelated dimensions, including the source of the threat, attack vector, targeted assets, and potential consequences of threat realization. The main conclusion of the study is the identification of significant differentiation in the threat landscape depending on the sectoral affiliation of the enterprise, which necessitates the application of specialized approaches to assessing and managing information security risks. The practical significance of the obtained results lies in the possibility of using the developed model to form targeted protection strategies taking into account the sectoral specifics and resource constraints of small businesses.