Assessment of Vulnerability Management Practices in Small and Medium Enterprises in Anambra State

Small and medium enterprises represent the backbone of Anambra State's commercial economy but frequently operate without systematic vulnerability management, creating exploitable security gaps that affect both their operations and their customers. This study assessed vulnerability management practices among SMEs in Onitsha, Nnewi, and Awka, Anambra State, South East Nigeria. A descriptive survey was conducted among 150 SME owners and IT managers using purposive and snowball sampling. The questionnaire assessed patch management frequency, vulnerability scanning adoption, third-party software update practices, endpoint security deployment, and security assessment budgeting. Results showed that only 21.3 percent conducted monthly or more frequent software patching. Automated vulnerability scanning tools were used by 12.0 percent. Third-party software was regularly updated by 54.7 percent, but only on receiving automatic prompts. Antivirus was deployed by 78.7 percent but endpoint detection and response tools by only 8.7 percent. No SME in the sample had conducted a formal security assessment in the preceding 12 months. Security budget allocation was zero for 66.7 percent of respondents. The study concludes that vulnerability management in Anambra State SMEs is reactive and inadequate. Recommendations include SMEDAN-partnered affordable vulnerability assessment services, subsidised security toolkits for registered SMEs, mandatory cybersecurity clauses in government procurement from SMEs, and awareness campaigns targeting the Anambra commercial sector.

Keywords: vulnerability management, SME cybersecurity, patch management, Anambra State, endpoint security