A Longitudinal Study on the Adoption of Cloud Computing in Micro, Small, and Medium Enterprises in Montenegro

Abstract

In recent years, small and medium enterprises worldwide have increasingly adopted digital technologies and cloud computing. The pace of this digital transition has varied across countries, and the socioeconomic conditions during the pandemic have further accelerated the digitalization of enterprises. This situation calls for an examination of the reasons, benefits, and risks associated with enterprises adopting cloud computing in different settings. Our study aimed to collect longitudinal data from 71 Montenegrin micro, small, and medium enterprises. We conducted a repeated measurement study with two measurement periods: 2017 and 2023. The quantitative results were analyzed alongside qualitative data from a semi-structured interview (N = 15) conducted in 2023. The findings revealed substantial shifts in SME attitudes towards cloud computing, highlighting key catalysts and influencing factors such as security, technological accessibility, external expertise, effort expectations, privacy, social influence, perceived security and safety, ease of use, and usefulness. These factors were examined in the context of global digital innovation, the impact of the COVID-19 pandemic, and recent cyberattacks that disrupted national e-services in Montenegro for 3–9 months. The findings provide new insights into how enterprises can become more prepared to effectively use cloud computing.

1. Introduction

In recent years, the global economy has undergone a digital transformation [1], largely driven by the principles of Industry 4.0 [2]. This shift aims to create a competitive, knowledge-based economy with all aspects of life integrated virtually. The digital transformation has brought “the use of new digital technologies, such as mobile, artificial intelligence, cloud, blockchain, and the Internet of Things (IoT) technologies” [3,4]. These advancements have enabled significant progress, particularly in the business sector.

In the European Union (EU), small and medium enterprises (SMEs) make up more than 99% of businesses [5]. Digital transition or transformation is crucial for these enterprises because modern digital solutions make business activities more resilient to crises and market changes, as well as more adaptable to customer needs [6]. Adopting modern digital solutions like cloud computing (CC), system integration, big data and analytics, and cybersecurity [7] enables SMEs to collaborate effectively with external organizations and share knowledge [6,8]. Enterprises can approach digitalization through various strategies—either gradually or through more radical, immediate transitions [9].

To begin with, in this study, cloud computing is considered a generic term for technologies that provide hosted services in a virtual space over an internet connection [8,10], thus allowing ubiquitous, on-demand network access to shared configurable computing resources (e.g., networks, servers, storage, applications, and services). These resources are based on the pay-per-use or utility-like billing model rather than the ownership of such resources [11]. CC deployment models include [11,12] public clouds, private clouds, hybrid clouds, and community clouds, offering server-level and application-level models [13,14]. Server-level services include Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS), while application-level services comprise Software-as-a-Service (SaaS). In this study, we consider any CC model adopted by SMEs, as our goal is to gain an understanding of the factors that can affect the adoption of CC in SME operations.

Although the shift to digitalization and the adoption of modern digital solutions are prevalent, several enterprises have needed help with their implementation [6,15]. Prior to the COVID-19 pandemic, no such substantial impacts on the digitalization of SMEs were evident. Internal and external factors contributing to SME digitalization were recognized [16,17]. The internal factors were technological efficiency adjustments, resource adjustments, and business model changes. In contrast, the external factors entailed external capacity and resource adjustments, government regulations, and industry and environmental protection factors. The COVID-19 pandemic in the period of 2020–2021 has only advanced the digitalization of SMEs even further, as businesses have had to cope with extraordinary economic and social challenges, despite the support of various government programs [8]. They incurred business interruptions, liquidity problems, job losses, and layoffs [18,19]. Enterprises were forced to undertake digital transformation if they wanted to survive, and many predicted that these changes in the business environment would continue after the pandemic [20,21,22]. In the post-pandemic period, an unexpected increase in demand led SMEs to difficulties in recruiting new staff [8]. As of spring 2022, almost all labor market indicators have returned to pre-pandemic levels, except customer-facing, restaurant and hostel sector jobs. However, there have been declines in the employment-to-population ratio as well as a shortage in the supply of labor force. There has been a consistent change in the workforce, including but not limited to layoffs, retirements, and even temporary layoffs, where employers expected the shock to be a temporary issue [19].

1.1. Cloud Computing Adoption in SMEs

Studies demonstrate that CC adoption in SMEs may be dependent upon various reasons or contextual factors. The first is the technology readiness rationale, which covers the technological readiness of an organization, where CC can complement or replace a platform or technology infrastructure. In particular, companies that employ specialists (computer scientists, etc.) are in a better position [23,24]. For the use of naïve employees who use CC, it is imperative to make them aware of how it operates (basic and updates) to eliminate any resistance they may have before using CC [25]. Second, the organizational context encompasses top management support, which should be considered a necessity for support from the upper management with regard to the introduction, implementation, and deployment of different IT technologies. This rationale encompasses providing a long-term vision, strengthening values, growing organizational relationships, and overcoming resistance to change [26,27]. Last but not the least, the environmental context contains competitive pressure and regulatory support [24]. Competitive pressure is the pressure competitors exert on an enterprise in the same industry [28]. The enterprises thus introduce CC mainly for the purpose of operation in the market [27,29], in which SMEs often require guidance and, in most cases, engage only after following large enterprises that set market trends [30]. Regulatory support refers to the support provided by the government authority to encourage IT innovation by enterprises [24,31]. Current legislation and policies can either encourage CC adoption in enterprises or act as barriers to it [29,32].

CC services allow SMEs to gain a competitive edge and be relevant in the information industry. They acknowledge different factors that include the following advantages in using CC services. The first perceived benefit is cost savings, as CC services allow SMEs to facilitate outsourcing more easily through a reduction in transaction costs [25,27,33,34,35]. In addition, infrastructure management and IT costs may be reduced [36,37]. Secondly, SMEs may perceive CC services as beneficial in terms of security by using information encryption, robust access control systems, key management, and security insight [38,39]. Thirdly, the staff of the whole enterprise may benefit, as CC services may encourage employees to communicate more efficiently and work together, which increases the productivity and efficiency of employees and has a further impact on the enterprise’s competitiveness in the market [40].

While CC provides many benefits for SMEs, the availability of risks concerning CC can be determined by SMEs and are divided into six groups by [41,42]. The first group is economic–financial resources, which include profitability, cost reduction, economic benefit, tax incentives, financial planning, difficulties in obtaining credit, and high costs of recruiting experts [43,44]. The second group includes legal risks, such as legal jurisdiction, regulatory concerns and pressures, and data security, as well as a lack of standards and questions regarding the reliability of systems and the confidentiality of corporate data [45,46]. The third group of risks is the competence/expenditure group, which includes usability assessment, lack of certified staff, staff resistance, constant staff turnover, and a lack of knowledge of staff capabilities and general knowledge of cloud computing [47]. The next group of risks is associated with the technical landscape that includes internet connectivity issues, incompatibilities, data security and privacy concerns, business reliance on the internet, and weak IT infrastructure [44,48]. The fifth group is associated with implementation or operational and customization issues, problems of coordination with partners, questions of ownership, and other general implementation issues [49,50]. The final group of risks is cultural issues, which include absence of trust, lack of interest or repudiation of the need for cloud computing, different perception of the value of governance, and lack of managerial interest in upgrading the IT department [44,48,51].

1.2. Nationwide Context of SME Digitalization: Montenegro

In addition to the crisis during the COVID-19 pandemic, countries worldwide have recently faced political, economic, and social obstacles specific to their region. For example, Montenegro, along with other Western Balkan countries, has been in the process of joining the European Union for several years and is reported to be a leader in that process [52]. However, several political and economic obstacles still create and determine a low level of social and economic development. This is well manifested in in the social (failed reforms, weak legal basis, poverty), political (lack of democracy, street protests), and economic (underdevelopment, high unemployment) spheres [52,53]. Montenegro’s goals and visions are to ensure that it conforms to the various EU policies on digitalization and technological advancement in its attempts to become economically and politically equal to other countries [54]. Hence, investments have been made in the development of e-government and digital skills, in building trust and digital security, the digitalization of industry, as well as in the adoption, implementation, and enforcement of the Digital Single Market acquis [55,56]. The starting points in the process can be found in national strategic documents, like the Strategy for the Development of the Information Society of Montenegro until 2020 [57], which identified cloud computing as a potential direction for ICT development in Montenegro, as well as the World Bank’s definition of cloud computing: According to Economic Report No. 73826-ME [58], Montenegro was preparing for prosperity within the “Platform for Development and Innovations.” However, one of the significant aspects that has attributed to making Montenegro particularly relevant for the study is a cybersecurity attack on governmental e-services in the year 2022. This attack resulted in the disruption of activity ranging from 3 to 9 months, which consequently raised concerns about the security of digital processes. The multi-day attack, which began on 22 August 2022, affected government servers and critical infrastructure, making website and emails unavailable. This one was the most extensive in scope and resulted in significant damage. In specific sectors, the energy sector and the finance sector experienced a greater impact. To overcome this issue of decline in the tax system, the state introduced the concept of the offline mode of operation. Due to the cyber threat to the state’s power system, the utility company Elektroprivreda had to temporarily suspend some of its services and transitioned them to manual operations to mitigate potential harm [59].

Therefore, it is essential to examine the factors that may have driven Montenegrin SMEs to potentially affect their intent to adopt CC over time and identify the differences that may have occurred in the recent period (2017–2023), the time between initial tangible steps towards digitalization and the quite unstable post-COVID-19 pandemic time, coupled with a significant cyberattack that paralyzed e-services, along with other global and national events and trends. However, it is also important to understand any changes that may have occurred in the perception of the benefits and risks of CC adoption before and after the COVID-19 outbreak.

However, studies reported in the literature have not taken into empirical consideration the long-term impacts of the unique political, economic, security, and social settings during the past five years on the digitalization of SMEs in terms of CC adoption. It was thus the main aim of our study to investigate more thoroughly and systematically how the reasons for, perceived benefits of, and risks of CC adoption have changed in recent years in Montenegrin SMEs and which factors have led to these changes. A quantitative study was conducted in 2017 and repeated in 2023 when a semi-structured interview was also employed to reinforce and elaborate the quantitative results and explain the quantitative findings. The repetition of the quantitative study was relevant for three reasons. Firstly, the first study was conducted in the time before the pandemic with an increasing trend of digitalization in Montenegro, followed by unprecedented challenges in the following years during the COVID-19 pandemic and a kind of stabilization in the post-pandemic time, when the second study was performed. Secondly, the comparison of data gathered in both studies is relevant, as the essential characteristics of CC have still largely remained unchanged or similar since 2017 to date [14,60,61,62]. Thirdly, in the context of the rapid development of technology and digitalization, we find it crucial to study the trends of CC adoption in recent years and the current state of CC in Montenegro to foresee its further development in the coming years.

This research enhances the body of knowledge on cloud computing by exploring its challenges, applications, and perspectives within the framework of multifactorial causal relationships, particularly in the context of crises, uncertainty, and the effect on technological innovations, especially cloud computing adoption by SMEs. Accordingly, this research indicates that crises alter SMEs’ perspectives, highlighting the advantages of cloud computing and encouraging its adoption among SMEs.

The present paper is novel in several ways. First, it empirically studies a unique situation where two distinct crises, a global COVID-19 pandemic and a severe cyberattack on Montenegrin e-government infrastructure, encompass a significant impact on SMEs in the digital environment. Second, it offers insights into how uncertainty and learning lead to behavioral changes within SMEs concerning the adoption and enhancement of cloud computing services.

2. Materials and Methods

2.1. Research Problem

Previous studies mainly concentrated on the identification and analysis of CC and its associated definitions and classifications, types, and deployment models in SMEs [12,13,14]. The employment of CC in SMEs was examined in a specific application area, such as accounting and finance [25,63,64], customer relationship management (CRM) [65,66], and project management [67]. In this context, studies were examining factors influencing the adoption of CC [24,66], as well as benefits and perceived risks of adopting CC for SMEs, from cost savings [25,27,33,34,35] to doubts regarding data security and privacy [42].

In view of the above research regarding CC adoption by SMEs, and taking into account the country-specific context in the period of digitalization initiatives at the national level (prior to the COVID-19 pandemic) to the post-pandemic period, the primary focus of this research is to determine whether there have been any changes in adoption practices, usage patterns, and attitudes of Montenegrin SMEs towards the concept of cloud computing. To this end, the following research questions are defined for the study.

RQ1: Were there any changes in Montenegrin SMEs in 2023 compared to 2017 regarding the following variables: the level of information security, reasons for adopting CC, perceived benefits of adopting CC, and perceived risks of adopting CC?

RQ2: Were there any changes in Montenegrin SMEs in 2023 compared to 2017 in the perceived suitability of five cloud computing deployment models (public cloud, private cloud, partner cloud, set of different cloud sources (partnership, private, etc.), other)?

RQ3: Were there any changes in Montenegrin SMEs in 2023 compared to 2017 in the perceived suitability of five cloud layers (SaaS, PaaS, IaaS, security cloud services, other)?

RQ4: Were there any changes in willingness to use multiple cloud service providers in Montenegrin SMEs in 2023 compared to 2017?

RQ5: Were there any changes in the intention to employ nine types of cloud computing adoption in Montenegrin SMEs in 2023 compared to 2017?

The methods applied to the analysis of the research questions were derived from two EU-funded projects: “Market oriented research on SME perspective about cloud computing solutions in ME—Cloud4SME@MNE” (ref.no: EuropeAid/136938/ID/ACT/ME) (implementation period: 2016–2017) [68] and “Overcoming Digital Divide in Europe and Southeast Asia—ODDEA” (ref.no: 101086381) (implementation period: 2022–2026) [69], as presented in the following sections.

2.2. Methodological Approach

The designed methodological approach, illustrated in Figure 1, integrates both quantitative and qualitative research, encompassing the following key elements:

• A longitudinal study with repeated quantitative measures in 2017 and 2023, aimed at capturing changes in CC perception among Montenegrin SMEs (output 1);
• Semi-structured interview designed to understand causal factors and enrich the study with evidence-based findings, thereby enhancing the digital posture of Montenegrin SMEs (output 2).

The combination of longitudinal and qualitative methods is well suited for evaluating the hypothesis, as supported by literature on SMEs operating in complex and dynamic environments where multiple factors interact over time [70]. Longitudinal data allow for the tracking of how these factors and experiences evolve, providing measurable insights into changes in SME development and perspectives. Additionally, in underdeveloped and developing nations, companies often hesitate to embrace change due to the costs associated with market-driven innovation [71,72]. Deep interviews are particularly valuable in these contexts, as they help unpack the complexities qualitatively by exploring the detailed experiences and perspectives of SME managers and decision-makers.

2.3. Ethics and Procedure

The study was designed and conducted in compliance with the World Medical Association’s Declaration of Helsinki [73] and the Ethical Guidelines released by the Association of Internet Researchers [74]. The target population consisted of SMEs operating in Montenegro. The quantitative research approach was initially conducted in 2017 (study 1) and repeated in 2023 (study 2), when a qualitative research approach was also applied. Ethical committee approval was obtained on 20 February 2017 from the Cloud4SME Quality Control Board.

An online survey was used to collect quantitative data. There were 30,238 Montenegrin SMEs that were registered in the Chamber of Commerce of Montenegro in 2017 and 45,618 in 2023 [75]. We conducted study 1 and study 2 with the same subjects in 2017 and 2023, respectively. Representatives of all registered SMEs were invited to participate in the study through three data collection steps. In the first step, an e-mail request with the online questionnaire was sent to SME representatives. In the second step, a telephone reminder and additional explanation of the need for data collection were provided to those who responded to the initial email contact. If identified SME had not yet completed the questionnaire, researchers visited them in person, explained the importance of the study, and invited them to complete the questionnaire in a paper-based format. The data collected on paper were then stored electronically in the database for further analysis.

Before implementing the survey questionnaire in study 1, we tested it with ten practitioners and five academic researchers familiar with cloud-based services. Based on their feedback, we made slight modifications to a few items to eliminate ambiguity and remove any suggestive or misleading questions. The original version of the questionnaire was in English, but the questionnaire was translated into Montenegrin. The translation was validated by sending the questionnaire to three academics at the University of Donja Gorica and two Montenegrin linguist teachers. We applied a “back translation” method [76] to ensure the quality of the translation and to identify any discrepancies in meaning between the original and translated version of the questionnaire.

Semi-structured interviews were conducted to collect qualitative data. Participants were randomly assigned representatives of SMEs and large enterprises who participated in studies 1 and 2. The data were collected face-to-face, audio-recorded, and transcribed [77]. The selection criteria for interview participants were (1) possessing the required level of knowledge about IT and cloud computing services, (2) being employed in SMEs that use some cloud computing services, and (3) having responsibility for making strategic IT decisions in their SMEs. Fifteen participants meeting these criteria were selected before the interview.

The interview preparation encompassed the following steps: (i) creating a semi-structured interview guide, (ii) setting administrative protocols, (iii) arranging appointments, and (iv) briefing the interviewees. The questions scheduled for discussion during the interviews were carefully designed to elicit the benefits and disadvantages associated with using cloud services. The interview guide was piloted with academic staff before interviews were conducted with representatives from chosen Montenegrin SMEs. All interviews were recorded, transcribed, and validated by the participants.

2.4. Quantitative Measuring Instrument

In the quantitative part of the study, the measuring instrument used was an online survey questionnaire.

Table 1. Concepts/variables in the measuring instrument (adapted from [78,79]).

Concept/Variable	Empirical Indicator	Cronbach’s Alpha Coefficient (Study 1)	Cronbach’s Alpha Coefficient (Study 2)
Level of information security	Categorical items (0—no, 1—yes). Ten items. Example: “A company has an official procedure for the management of physical safety of people and propriety”.	0.837	0.791
Reasons for adopting cloud computing	Categorical items (0—no, 1—yes). Ten items. Example: “Removing economic/expertise barriers impeding the modernization of business processes by the introduction of information technology”.	0.701	0.607
Perceived benefits of adopting cloud computing	Categorical items (0—no, 1—yes). Ten items. Example: “Reducing the cost of investment in new ICT solutions”.	0.823	0.689
Perceived risks of adopting cloud computing	Four-point Likert scale items (1—not important; 4—extremely important). Twelve items. Example: “Losing control over services and/or information”.	0.936	0.744
Perceived suitability of five cloud computing deployment models	Categorical items (0—no, 1—yes). Five items, considered separately: public cloud (ownership and management is entrusted to an independent company), private cloud (ownership and management by the cloud service providers), partner cloud (ownership and management entrusted to the partner), a set of different cloud sources (partnership, private, etc.); other	/	/
Perceived suitability of five cloud layers	Categorical items (0—no, 1—yes). Five items, considered separately: the individual software packages (SaaS); complete operating system and software packages available in the cloud (PaaS); only infrastructure services, such as warehouse (storage space), network capacity, and so on. (IaaS); security cloud services; other	/	/
Willingness to use multiple cloud service providers	Categorical items (0—no, 1—yes). Example: “Would you be willing to outsourcing services to several cloud providers?”	/	/
Intention of employing nine types of cloud computing adoption	Categorical items (0—no, 1—yes). Nine items, considered separately: payroll, human resources, procurement CRM/retail, accounting and finance, project management, development of applications in the cloud, analysis of anonymous data, other	/	/

shows concepts or variables covered in the measuring instrument, empirical indicators, and sources from the literature. The variables were measured according to the actual needs, requirements, and expectations of SMEs for cloud computing services, as reported in a survey conducted by the European Union Agency for Cybersecurity (ENISA) [78]. In measuring the perceived benefits of adopting CC, we followed Ref. [79].

2.5. Qualitative Measuring Instrument

In the qualitative part of the study, the measuring instrument was a semi-structured questionnaire. The questions were open-ended, and the interview topics were based on the concepts presented in Table 1, with the key goal to investigate factors influencing the documented change in CC perception by Montenegrin SMEs. The objective of the study is to confirm or reject the factors recognized in prior studies, elaborate on their effects and, if needed, to introduce new factors that have not been identified in prior research. For that purpose, the theoretical concept of clusters of influencing factors was applied, which is the integrated model that unites the technological, organizational, and environmental framework (TOE) [80] and the individual dimension (unified theory of acceptance and use of technology—UTAUT) [81]. An overview of the clusters of factors that have been identified, shown in

Table 2. Influencing factors for semi-structured interviews.

Cluster	Influencing Factors	Source
Technological	Relative advantage	[82,83]
	Cost (capital costs, cost reduction)	[13,84,85,86]
	Security and privacy	[86,87,88]
	IT flexibility	[13,89]
	Complexity	[88]
	Technological availability	[13,89,90]
Organizational	Size and structure	[88,91]
	Top management support	[89]
	Innovativeness	[24,88,91]
	Prior technological experience	[24,90]
	Service controlling	[92]
	Supplier computing support	[24,91]
	Usage frequency	[13]
Environmental	Competitive pressure	[93,94]
	Sector (main activity)	[24,95]
	Market scope	[89]
	Social influence	[24]
Individual	Trust	[13,84,86]
	Perceived usefulness	[13]
	Perceived ease of use	[13]

, is based on literature sources. The interviewees were not influenced or restricted in their responses by any prior knowledge of the list of identified influencing factors.

2.6. Statistical Analyses

In the preliminary analysis of the quantitative study, we inspected the internal consistency of the variables in which more than one empirical indicator was supposed to measure one variable according to the literature. We calculated the Cronbach’s alpha coefficient (see Table 1). In our study, both the samples were classified as paired samples. We inspected the normality of the data for each research question by employing the Shapiro–Wilk test. As there were deviations from the normality of the data, the data were analyzed using the Wilcoxon signed-rank and McNemar tests. A p-value of <0.05 was considered statistically significant, and SPSS 29.0 was used to analyze the data.

The data analysis of the information collected during the interviews was conducted in several steps: In the first step, all gathered data were translated and transcribed for the second step to enhance the process of content analysis [92,93]. The content analysis was focused on matching the coding scheme to the concepts provided in Table 1 and reviewing the literature on the influencing factors presented in Table 2. Three researchers were engaged in order to obtain cross-observer reliability, and the MAXQDA v.2022 data analysis software was used. In cases where there were discrepancies in the experts’ results, the majority decision was accepted. Subsequently, the categorization of influencing factors was conducted using the extended TOE with the UTAUT framework. This involved aligning with existing factors as well as identifying and interpretating new ones. Finally, a frequency analysis was performed to accurately assign weighting factors, allowing for the visualization of their impact within designated categories.

To present the findings, we coded the subjects’ answers: M = micro SME, S = small SME, MS = medium-sized SME.

3. Results

3.1. Results of the Quantitative Study

3.1.1. Sample

In the quantitative part of the study, the researchers invited 300 registered SMEs to participate voluntarily. In study 1, 100 SMEs responded. In study 2, the researchers invited all SMEs that had responded in study 1. Finally, 98 SMEs responded; thus, the subject retention was satisfactory. During the data screening, 22 enterprises were excluded from further analysis—they had more than 250 employees, 2 as they grew from SME to large enterprise in the four years, and 3 as they deemed themselves large enterprise. Finally, 71 SMEs were included in the statistical analysis.

Table 3. Sample characteristics (n = 71).

		Study 1		Study 2
Category	Description	Frequency (n)	Percentage (%)	Frequency (n)	Percentage (%)
Company size	Micro (1–9 employees)	11	15.50	7	9.86
	Small (10–50 employees)	30	42.25	33	46.48
	Medium-sized (50–250 employees)	30	42.25	31	43.66
Main activity	Manufacturing and industry	5	7.04	5	7.04
	Finance services	9	12.67	9	12.67
	Public sector and health	12	16.90	12	16.90
	Private sector	7	9.86	7	9.86
	ICT service	8	11.27	8	11.27
	Retail	6	8.45	6	8.45
	Other	24	33.80	24	33.80

shows the essential characteristics of the sample.

Table 4. ICT background of the sample.

		Study 1		Study 2
Category	Description	Frequency (n)	Percentage (%)	Frequency (n)	Percentage (%)
Total number of computers in the company	Do not use computers	0	0.00	0	0.00
	Up to 5 computers	9	12.68	4	5.63
	5–10 computers	3	4.22	4	5.63
	11–20 computers	10	14.08	12	16.90
	21–50 computers	23	32.39	24	33.80
	More than 50 computers	26	36.62	27	38.03
Applications used in the company	Mail	70	98.59	71	100.00
	Skype	30	42.25	41	57.7
	Company’s social networks	31	43.66	46	64.79
	Blogs and microblogs	9	12.68	9	12.68
	Microsoft Office	65	91.55	65	91.55
	Enterprise resource planning (ERP)	36	50.70	36	50.70
	Customer relationship management (CRM)	19	26.76	4	5.63

shows the ICT background of the sample. In the first study, the average percentage of business processes supported by ICT was 76.77% (SD = 20.46%), while in the second study, the average percentage was 83.45% (SD = 15.18%).

3.1.2. Results of Research Questions

To analyze RQ1, related to the changes in attitudes towards CC adoption and information security posture at SMEs, we separately tested the mean difference of paired questions in 2017 and 2023 as follows.

The statistical analysis revealed that the mean difference of paired observations of information security of SMEs between 2017 and 2023 was statistically significant (Z = −4.61, p < 0.001). The result indicates that SMEs’ information security level in 2023 (M = 8.06, SD = 2.22) was significantly higher than in 2017 (M = 7.63, SD = 2.57). The effect size was medium (r = −0.39).

The statistical analysis revealed a statistically significant difference of paired observations of reasons for CC adoption (Z = −2.74, p < 0.05). Namely, the number of reasons for CC adoption in 2023 (M = 2.28, SD = 1.85) was statistically significantly lower than in 2017 (M = 2.52, SD = 2.17). The effect size was small (r = −0.23). Further analysis with the McNemar test was employed to inspect whether there were differences for a single reason for CC adoption; these were statistically significant for ensuring business continuity and rapid system recovery (χ² = 4.17, p < 0.05). It indicates that the proportion of those that did not recognize this reason as crucial for introducing CC in SME neither in 2017 nor in 2023 was 57.75%, while there were no SMEs that considered this reason unimportant in 2017 and essential in 2023. Moreover, 8.45% of SMEs admitted this reason as necessary in 2017 but unimportant in 2023. Finally, 33.80% of SMEs identified this factor as having relevance to CC adoption both in 2017 and in 2023.

We found no changes in perceived benefits of CC adoption (p > 0.05). In contrast, we found a statistically significant difference in perceived risks of CC adoption (Z = −2.18; p < 0.05). The result indicates that, on average, SMEs’ perceived importance of CC adoption risks in 2023 (M = 36.51, SD = 4.76) was significantly lower than in 2017 (M = 37.23, SD = 7.95). The effect size was small (r = −0.18).

Discussion. It is imperative to explore the factors behind the decreased interest in cloud solutions, as all evidence suggests the growing trend of digitalization within the business sphere, particularly among SMEs during the mentioned period. Conversely, the increased emphasis on cybersecurity can be regarded as a direct response to recent cyberattacks. It is crucial to assess the systematic approach in this respect and ascertain whether companies have adopted a comprehensive strategy that would also encompass human capital development or improvement, technology advancements, supportive measures, and legal instruments for enforceability.

Related to RQ2 and RQ3, statistical analysis revealed no statistically significant changes in perceived suitability in 2023 compared to 2017 in any of the five CC deployment models (p > 0.05). Likewise, no statistically significant difference was found in variability in the perceived suitability of any of the five cloud layers (p > 0.05).

Discussion. The absence of change in the perceived suitability of CC deployment models and cloud layers may be attributed to the continuity of operating within the same business sector and type, leading to consistent requirements for cloud services. However, the rapid innovation trends in cloud service development warrants investigation, alongside the potential for technology-driven business transformation and expansion.

Related to RQ4, McNemar’s test revealed a statistically significant difference in the proportion of SMEs willing to use multiple cloud service providers in 2017 and 2023 (χ² = 16.96, p < 0.001). Twenty-four SMEs not willing to use multiple cloud service providers in 2017 were willing to use these providers in 2023. Moreover, 25.25% of SMEs not willing to use these providers in 2017 were not willing to use them in 2023 either. Likewise, 38.03% of SMEs willing to use these providers in 2017 were also willing to use them in 2023. However, only 2.82% of SMEs were willing to use the providers in 2017, while they were not willing to use them in 2023.

Discussion. The observed positive shift in the number of companies seeking to adopt cloud services can be attributed to the COVID-19 pandemic and the widespread introduction of digital products. Certainly, the persistence of traditional business models and the adverse effects of online operations, such as business disruption following cyberattacks, may also significantly influence these decisions.

Finally, related to RQ5, we found no changes in the intention of any of the nine CC adoption types (payroll, human resources, procurement, CRM/retail, accounting and finance, project management, development of applications in the cloud, analysis of anonymous data, other) between 2023 and 2017 (p > 0.05).

Discussion. At first glance, this outcome seems directly linked to the results of RQ2 and RQ3, as well as the continuity of operating within the same business sector and type. However, considering that positive experiences with service implementation (typically involving payroll and project management) often pave the way for recognizing further enhancements and introducing new services, other potential factors, such as investment costs, expenses, etc., should also be taken into consideration.

3.2. Results of the Qualitative Study

After an independent analysis of the interview content by three researchers and further matching with influencing factors (Table 2) and frequency analysis, the following findings were generated and are presented in

Table 5. Evaluation of impacting factors based on semi-structured interviews.

		No. of SMEs with Assessed Impact (% Out of 15)
Cluster	Impacting Factor	Medium and High	Low	Without Impact
	Cost reduction	6 (40.00%)	1 (6.67%)	8 (53.33%)
	Strategic impact	7 (46.67%)	6 (40.00%)	2 (13.33%)
Technological	IT flexibility	8 (53.33%)	4 (26.67%)	3 (20.00%)
	Technological availability	10 (66.67%)	0 (0.00%)	5 (33.33%)
	Security	12 (80.00%)	3 (20.00%)	0 (0.00%)
	Deferral option	0 (0.00%)	1 (6.67%)	14 (93.33%)
	Uniqueness	0 (0.00%)	10 (66.67%)	5 (33.33%)
	Asset specificity	0 (0.00%)	1 (6.67%)	14 (93.33%)
Organizational	Service controlling	2 (13.33%)	3 (20.00%)	10 (66.67%)
	Roles and responsibilities	4 (26.67%)	5 (33.33%)	6 (40.00%)
	Organization size	0 (0.00%)	6 (40.00%)	9 (60.00%)
	Complexity	5 (33.33%)	3 (20.00%)	7 (46.67%)
	Effort expectation	6 (40.00%)	1 (6.67%)	8 (53.33%)
	External know-how	8 (53.33%)	1 (6.67%)	6 (40.00%)
Environmental	Energy efficiency	2 (13.33%)	0 (0.00%)	12 (80.00%)
	Competitive pressure	2 (13.33%)	6 (40.00%)	7 (46.67%)
	Image	3 (20.00%)	3 (20.00%)	9 (60.00%)
	Subjective norm	4 (26.67%)	4 (26.67%)	7 (46.67%)
	Industry characteristics	5 (33.33%)	4 (26.67%)	6 (40.00%)
	Social Influence	7 (46.67%)	2 (13.33%)	6 (40.00%)
	Privacy	9 (60.00%)	0 (0.00%)	6 (40.00%)
Individual	Trust	4 (26.67%)	5 (33.33%)	6 (40.00%)
	Perceived usefulness	5 (33.33%)	5 (33.33%)	5 (33.33%)
	Perceived ease of use	7 (46.67%)	7 (46.67%)	1 (6.67%)
	Perceived security and safety	9 (60.00%)	1 (6.67%)	5 (33.33%)

.

3.2.1. Technology Perspective

The technological perspective has identified six factors that influence SMEs’ views towards CC: security, technological availability, IT flexibility, reduced IT investment costs, and the strategic importance of IT. The remaining three factors—deferral option, uniqueness, and asset specificity—were not indicative for the respondents. Out of 15 respondents, 12 identified security as crucial for the implementation of cloud services. Contrary to previous research, during interviews, experts positively evaluated the security factor. As SME1 stated, “Thanks to cloud services, the security of company data is at a significantly higher level than we can provide with our resources.” Similarly, SME6 emphasized the importance of security, stating, “After the cyber attack on government institutions, we immediately decided to use cloud services that provide greater security against current cyber threats”, indicating increased trust in cloud services for security.

However, some respondents still expressed concerns about the confidentiality of their data in the cloud, expressing doubts that someone might misuse them. SME12 pointed out, “We don’t have enough data from cloud service providers about their techniques and access control protections, so there is a possibility that someone could access and analyze our data without our knowledge.”

Ten respondents positively evaluated the technological availability of cloud services. Most of them particularly emphasized the need for more cloud service providers from Montenegro. SME11 noted, “I wish the availability of cloud services offered by Montenegrin companies like/…/could be increased and more comprehensive, as it would enhance our trust in them.” As a positive example mentioned was the use of cloud services for creating electronic fiscal invoices.

Regarding IT flexibility, eight respondents had favorable comments. SME7 stated, “Cloud services like/…/significantly enhance flexibility in work regardless of location and working hours, reducing dependence on individuals.”

3.2.2. Organizational Perspective

The organizational perspective included nine factors, six of which were identified during the interviews. Compatibility, trialability, and lock-in effect were not mentioned by any respondents. The remaining factors—external know-how, effort expectation, complexity, organization size, roles and responsibilities, and service controlling—were highlighted by at least some respondents.

Most decision-makers, eight of them, emphasized the significance of the external know-how factor, considering it crucial for their companies. As SME1 stated, “Jobs for which we cannot find suitable experts are outsourced to professionals or companies we partner with.” In the same context, six experts highlighted the effort expectation factor. For instance, SME8 noted, “The costs of employing IT experts to maintain and develop IT infrastructure are significantly higher than the cost of cloud services. In case of an employee termination, we would have a significant challenge to find a replacement in a short period.”

The size of the organization also influences the use of cloud services. Four respondents pointed out a high dependence on cloud service adoption, especially in larger companies, while representatives of small businesses classified their reliance on cloud services as low or medium. SME14 emphasized, “The implementation of cloud services in our organization is critical. If their availability is compromised, the efficiency of our company’s operations would be significantly endangered.”

Additionally, four respondents highlighted the need to define access rights to cloud services based on roles within the company. SME9 explained, “Our company uses cloud services for document management, and it is necessary to provide different access rights to files according to each employee’s responsibilities and job descriptions. Therefore, we need cloud solutions that enable this, even though such solutions are sometimes much more expensive compared to other similar cloud services that do not offer role separation and access rights.”

Only two respondents stressed the need for more significant monitoring and control of cloud services, primarily for security reasons. SME3 stated, “Our security procedures require continuous monitoring and reporting of any security incidents. When choosing cloud services, we require additional monitoring and control over their use by our employees and partners. Cloud service providers often cannot provide such forms of control over their services.”

3.2.3. Environmental Perspective

For the environmental perspective criterion, we analyzed factors such as energy efficiency, competitive pressures, image, subjective norm, industry characteristics, social impact, and privacy. Most respondents (9 out of 15) emphasized the need to preserve privacy when using cloud services. SME10 stated, “The Montenegrin mentality has always problematized the need to ensure privacy. Despite legal solutions that clearly define norms of behavior to protect privacy, information is often exchanged informally in a way that significantly compromises the privacy of individuals and organizations.” This highlights the lack of enforcement and sanctioning of legally prescribed standards.

Industry characteristics and social impact were also recognized as significant factors influencing the use of cloud services. Respondents from industries such as tourism highlight the importance of cloud services for efficient analysis of customer demands and specific markets, thereby enhancing their competitiveness. SME13 emphasized, “When planning a new tourist season, we use services to analyze the tourism potential of specific markets. Based on that information, we set prices and make contracts. Storing data and using BI services on such cloud systems would significantly increase the risks of losing competitive position and know-how resources”.

Competitive pressure was another important factor highlighted by two respondents. SME7 mentioned difficulties with international competitors, stating, “Foreign companies have greater access to and use of modern technological solutions, and we are increasingly unable to keep up with this trend, thus losing certain markets”.

The least mentioned ecological factor was energy efficiency. Only two respondents indicated that using cloud services significantly reduces electricity consumption and thus helps protect the environment. It is also understandable that many SMEs do not have a well-developed awareness of environmental preservation, considering their impact (both positive and negative) on maintaining a healthy environment to be minor.

3.2.4. Individual Perspective

Individual perspective includes factors such as perceived ease of use, perceived usefulness, trust, and sense of security. Nine respondents emphasized the importance of trust in cloud service providers to deliver contracted services reliably and efficiently. They noted that over the past four years, they have switched cloud service providers due to loss of trust when expected services, especially regarding security, were not provided. SME13 stated, “After frequent cyber-attacks on the our website caused it to be non-operational for a couple of days, the provider requested additional payments to restore the system, claiming that they were not obligated by contract to provide protection against such cyber-attacks. Following a similar cyber-attack later on, we lost trust in the cloud service provider and engaged another one”.

Seven respondents highlighted the importance of the ease of using cloud services for their effective implementation. SaaS solutions were specifically noted for the perceived usefulness of these cloud services in enhancing work efficiency. SME3 emphasized, “In addition to providing greater flexibility in work from both a time and a geographical perspective, SaaS services need to be user-friendly to be acceptable to the majority of users”.

Finally, Figure 2 visualizes the influencing factors in a tree diagram, with assigned weights (min = 0, max = 3) calculated as the average weighted sum of evaluation results presented in Table 5. The diagram can assist decision-makers in adopting cloud computing solutions and further elaborating on different scenarios [96].

4. Discussion

This research study aims to enhance our understanding of cloud computing adoption among SMEs in small, pre-EU-accession countries such as Montenegro. It seeks to identify the impacts of factors such as the COVID-19 pandemic, national processes, national context, and recent cyberattacks on the operations and decisions of these firms. Over the period from 2017 to 2023, changes in SME perspectives towards cloud computing were observed. The survey analysis revealed a notable improvement in SMEs’ information security level, aligning with a statistically significant increase in mentioning the necessity to ensure business continuity and prompt system recovery as a primary factor driving cloud computing adoption (RQ1). Additionally, there was an increase in the proportion of SMEs willing to use multiple cloud service providers (RQ4).

From the interview results, four factors emerged as most frequently emphasized by all respondents: security, privacy, perceived security and safety, and external know-how. While categorized within different perspectives of the TOE and UTAUT frameworks, their interdependence is crucial, as they reflect a multidimensional aspect of cybersecurity that integrates technological, organizational, environmental, and individual perspectives. These factors were mentioned by all fifteen respondents, with each citing at least two of these four factors and 90% mentioning three out of the four. This further underscores the relevance in the acceptance and adoption of cloud services, highlighting them as a key driver for SMEs adopting cloud solutions and services.

Supporting our conclusion is the fact that most respondents noted that a cyberattack on critical state infrastructure in August 2022 prompted them to change their previous perceptions of the importance of cloud computing. The consequences of the cyberattack led to many government e-services being non-functional for several months (3–9 months), hindering SME operations and raising awareness about the significance of business continuity systems and improved information security systems.

Faced with contemporary cybersecurity challenges, most SMEs have drastically changed their stance from 2017, realizing the actual utility value of cloud computing, primarily in terms of enhancing their information security systems (RQ1).

Furthermore, the increased availability and flexibility of information technologies, along with potential cost savings in IT investments, have significantly motivated SMEs to utilize a wider range of cloud services more extensively. This includes primarily SaaS and security cloud services, with PaaS and IaaS being used to a lesser extent (RQ3).

The use of cloud services is primarily based on efficiency, purposefulness, and ease of implementation and use, regardless of whether they are provided within a private, public, or hybrid cloud environment (RQ2).

Compared to 2017, there has been a significant improvement in SMEs’ self-awareness of their own capacities and needs, best reflected in the emphasis on the importance of organizational factors of external know-how, complexity, and organization size. Most SMEs highlighted the importance of CC providers’ readiness to understand their organizational characteristics and individual capacities (ease of use, perceived usefulness, trust, and a sense of security) when selecting a CC provider. Consequently, in recent years, Montenegrin SMEs have been using cloud services from various cloud service providers (RQ4), primarily guided by their specific organizational requirements and the providers’ ability to meet those demands effectively.

Finally, it is essential to emphasize that these four factors have significantly increased SMEs’ awareness of the necessity of using CC services to achieve and maintain competitiveness in the market. Awareness of the negative impact of cyber threats on business continuity has driven SMEs to respond effectively to this modern challenge. The complexity of this issue requires not only the engagement of IT professionals but also the adoption of appropriate CC services. Unlike in 2017, management now recognizes that these services can provide multiple benefits: cost savings, more efficient management of IT infrastructure, a higher standard of security, improved communication, and increased productivity (RQ5).

Interestingly, in contrast to previous research findings, the main change has been a shift from the fear of data loss as a major barrier to adopting cloud solutions (as seen in 2017) to the primary motivation for implementing solutions to mitigate potential losses (as of 2023). The COVID-19 pandemic, which demonstrated the necessity of operating in a digital environment, and the significant cyberattack that highlighted the need for business protection in the digital realm, are seen as the main catalysts for this change. These circumstances have driven a business transformation in Montenegrin companies and send a clear message to other players on the global stage.

Finally, in a small nation like Montenegro, it is crucial to consider context-specific factors that closely align with the unique conditions and circumstances of the Montenegrin market.

5. Conclusions

In this paper, we investigated how various trends and factors influence changes in SMEs’ perspectives on cloud computing. Montenegro serves as a highly suitable case study, systematically presenting the whole spectrum of positive and negative influencing factors. These include the national contexts of EU integration and orientation towards digitalization, global aspects of digital innovation and the COVID-19 pandemic, and recent cyberattacks that paralyzed national e-services for 3–9 months, increasing skepticism and resistance to migrating business data and processes to the cloud. The findings presented here have numerous theoretical and practical implications, as follows.

Cloud systems have seen significant demand among SMEs aiming to thrive in competitive markets. However, there is a noticeable lack of studies focusing on SMEs in smaller markets like Montenegro. This research addresses this gap by developing a longitudinal measure of change over seven years, which is pivotal for facilitating business transformation. Additionally, it aims to provide a comprehensive understanding of the TOE and UTAUT frameworks, elucidating their significance in this context. Integrating TOE and UTAUT theories within a longitudinal study represents a novel research approach and is a significant theoretical contribution of this paper.

This paper also has practical implications for both user practitioners and vendors. For user practitioners, it offers insights into cloud characteristics that can facilitate successful adoption of cloud solutions within SMEs, addressing their concerns as reported by the study’s participants. Cloud providers are encouraged to forge closer partnerships with SME users and aid in raising awareness among owners, managers, and decision-makers. It is recommended that capacity-building programs in information security, along with practical guidelines, be employed as pivotal mechanisms to mitigate the risk of failures and enhance user acceptance.

Several limitations in this study suggest directions for further investigation. Firstly, the five-year period covered (2017–2023) may not fully capture longer-term trends or changes beyond this timeframe. This is particularly relevant given the growing interest in blockchain technologies as a transformative layer for cloud-based solutions.

Secondly, the main goal of this study was to gather comprehensive insights from SMEs in Montenegro, so perspectives from other regions and countries were not included. Future research could explore cross-regional comparisons and investigate specific business sectors and emerging trends in digitalization. Additionally, the sample was drawn from a limited number of SMEs and categorized only by company size. Including other indicators like financial performance, investments, years of operation, and entrepreneurial status could enrich the analysis. Future studies could expand the proposed methodology by providing a more detailed quantification of causal factors and assessing their resilience to market uncertainty and dynamic changes.