Greater Cybersecurity Will Only Be Gained By Reducing Over-Reliance on Technology

1

Greater Cybersecurity Will Only Be Gained By Reducing Over-Reliance on Technology

ACO 131 – Global Cybersecurity

Arizona State University-Tempe

2

Greater Cybersecurity Will Only Be Gained By Reducing Over-Reliance on Technology

Organizations worldwide face the ever-shifting landscape of the cyber threat as a primary

challenge. It is becoming a serious matter that requires ever-present alertness and holistic

consideration. Technological progress has afforded us highly sophisticated security measures,

but a blind trust in technology has actually created security exposures (Hasan et al., 2021). This

is due to the fact that cyber threats are always changing, and sole technological reliance may

make you feel safe (Salahdine & Kaabouch, 2019). By accepting that technology-centric cyber

(Tunc et al., 2022). This essay is intended to point out that cybersecurity is the pivotal problem

that needs to be dealt with systematically in order for us to obtain a proper balance between

technological measures and human-oriented solutions. Simply relying on technology is not a

employees are taught about best practices and changes are made as per the present organizational

needs.

Limitations of Technology-Centric Cybersecurity

The emergence of new technology is the main concern in cybersecurity. Companies are

always using the latest security equipment; however, this equipment becomes outdated or

3

vulnerable to new threats very fast (Yaacoub et al., 2022). Faults in software and hardware,

along with interconnected systems, can be used by cyberattackers as entry points (Al-Sartawi,

multi-layered, adaptive security that encompasses people, processes, and technology is the core

of successful cyber risk management.

are dissatisfied or careless, along with insider threats, greatly compromise the safety of

organizations (Walton et al., 2021). Organizations that are overly dependent on technology often

overlook the crucial role that employees and human behavior play in establishing a robust

prevent. According to Salahdine and Kaabouch (2019), training and awareness can address

human error, which starts with clicking on untrustworthy links, data loss, and the creation of

massive security risks. Also, Hsia et al. (2019) suggest that a holistic approach to cybersecurity

includes systematic and purposeful management of both the technological and human aspects

through steady improvement and efficient monitoring. Cybercrime does not discriminate against

individuals; rather, it exploits the vulnerabilities that criminals can easily exploit.

4

One of the subtler issues in cybersecurity is the lack of appropriate human supervision

because of overreliance on automation. Ali and Jali (2018) contend that in the initial phases of

these issues is and will continue to be of intrinsic social value because systems will always

require human social systems intuitive crisis diagnosis and contextualization in real-time. It is

precisely these issues that are solvable with automation. In addition to this, Salim (2014)

emphasizes the importance of systems thinking as a critical dimension in cybersecurity risk

and human cognitive integration.

The tendency for organizations to maintain well-structured security postures is

undermined by the rapid pace of technological advancements. Within the manufacturing sector

of industrial critical infrastructures, gaps in protection are created when advancements in

technology outstrip the improvements in cyber security readiness (Ani et al. 2017). These gaps

5

are not exclusively technical. They are also managerial in nature. Organizations are failing to

align their innovations. Sustainable digital transformations are possible when the intersections of

(2017) on OSINT and security awareness highlights the need for integrating tools into a

comprehensive security framework instead of incorporating them as isolated components.

Without a cohesive framework cyber security systems will constantly lack the synchrony needed

to keep pace with the cyber security threats.

Ngwenya et al. (2019) explain that virtual learning environments with sophisticated identity-

aware technologies still experience significant lapses in cybersecurity because users do not

engage in expected behaviors. This finding implies that technological defenses do not preclude

element in the cyber crisis management process is far more important in mitigation than any

protective measures that can be put in place on a static system. This point counters the narrative

that with more technological advancements, one will get more security. Antikainen (2014) makes

a similar point concerning the human element in the interpretation of situational awareness and

complex data streams. The need for human cognition indicates that cross-disciplinary efforts and

education are vital in cyber resilience. In the same line of thought, Ali and Jali (2018) emphasize

6

the pivotal role of human-technology interface to cyber stability, particularly in rapidly evolving

digital environments. This idea suggests that systems will remain fragile without the appropriate

prioritized for cyber defense efforts to be effective.

Cybersecurity frameworks oriented around defense mechanisms prioritize the

deployment of such mechanisms as opposed to the integration of the disparate systems of

unverified and contextually misunderstood information poses a considerable risk and can even

become a weakness, thus, an information-centric technology system that does not include

information verifications will become a thwarted structure. Salim (2014) defines the

compounding outsized negative effect on an entire computation system if a faulty element of an

entire network system is not continuously monitored. This explains the importance of a system’s

continuous learning and adaptive monitoring. In addition, during a crisis, Suresh (2018) stresses

the importance of accurate communication intersecting between people and machines, for

coordinated action to occur. This reveals the importance that the interaction of belief systems

held by humans, which is synergized with rational systems of digitized and automated

7

instruments, is an ultimate form of defense system against the unpredictability of the entire

digital ecosystem.

Infrastructural interdependence increases the vulnerabilities associated with modern

cyber security environments. In the case of Ani et al. (2017), interconnected industrial systems

increase the exposure points of connected systems to the extent that it becomes impossible to

contain a threat within a single domain. The need to reassess the cyber defensive perimeters

moving beyond the defensive architectures to perimeter security suggests the overwhelming

complexity in such systems requires operational as well as educational solutions (Ngwenya et al.

2019). That complexity must be understood not just as a technological issue, but as an

operational and educational issue as well. Infrastructural interdependence captures the essence of

predictive cyber security and governance in an organizational context.

Sophisticated technology may create an organizational veneer of control, hiding

weaknesses underneath. Suresh (2018) observes that organizations developing cyber crisis

protocols often presume the systems to be predictable, while the human factor overwhelmingly

determines the behavior during crises. The expectation-behavior gap compromises security plan

integrity. Antikainen (2014) further argues that the organization’s culture must institutionalize or

8

fixed rules. Cultures of learning will mitigate the organizational overconfidence that over

reliance on static solutions provides. As Ali and Jali (2018) argue, technology-focused

for the effective functioning of a system to completely breakdown. Salim (2014) supports this

view by illustrating the systemic nature of cyber risks and the corresponding systemic

governance requirements resulting from the interconnectedness of the digital world. These

the advanced digital tools of the current technologies. Suresh (2018) adds that effective crisis

intervention is the result of interpersonal trust networks that are substantially pre-established and

can be mobilized to confront the crisis. Sociology and social structure are, therefore, intrinsic to a

nation’s cyber security alongside the technology. Ali and Jali (2018) clarify this by emphasizing

the societal adaptability and resilience at the macro level of the human-technology continuum.

9

With this in mind, national security in the future will be more about the social intelligence of the

operators and less about hegemonic possession of technology.

Education is most generally underused in cybersecurity strategy. As noted by Ngwenya et

al. (2019), ‘digital learning platforms … equipped with state-of-the-art self-analysis features …

do poorly when users do not have even a rudimentary understanding of the basic principles of

cybersecurity’ (p. 127). This highlights the difficulty of incorporating security literacy into the

digital culture. Suresh (2018) rightly asserts that training concerning the management of crises

improvement of situational awareness with the mastery of information by asserting that

education ‘enhances’ (p. 6) interpretive acuity. Cybersecurity education empowers employees by

transforming them from potential risks into active defenders of the organization's digital

integrity.

Within a cybersecurity strategy, the use of open-source intelligence (OSINT) can be

valuable and detrimental. As Tabatabaei and Wells (2017) state, OSINT improves threat

anticipation by supplying contextual information that closed systems do not provide. Conversely,

the same openness that aids defenders also helps adversaries, highlighting a pivotal downside to

digital transparency. Without systems-level controls, OSINT can create uncertainty instead of

16

sectors allows for the governance of cybersecurity to be enhanced because shared frameworks

facilitate awareness of and the exchange of threats. Fragmentation around collaborative

an ecosystem. Strategic cohesion is a product of systemic unity, as their findings suggest. Jacob

et al. (2019) continues the conversation by stating that the integration of different academic

disciplines can fill the gaps left by institutions and is a channel to share disciplines of technology

and policy. The point of these studies is that the holistic model for cybersecurity is the view of

acknowledges that digital defense is one of collaboration.

Holistic cybersecurity nurtures adaptive learning as well as continuous innovation. As

cited by Rege (2015), it is multidisciplinary experiential programs that create reflexive

adherence. It is this type of adaptability that forms the basis of organizational resilience in

unpredictable times. Taitto et al. (2018) demonstrate that the incorporation of experiential

learning with holistic simulation systems gives rise to feedback loops that facilitate the iterative

evolution of practices in cybersecurity. Such feedback captures the essence of dynamic policies

as opposed to static frameworks. According to Barclay (2014), this type of adaptability is what

connects with maturity modeling as he demonstrates that continuous advancement in

17

differentiated pathways is possible through the sustained assessment of defined performance

metrics. He further demonstrates that learning organizations outpace their adversaries in

a learning focus, and within this paradigm, the core of the defense is adaptability.

Holistic methods enhance human decision-making by refining cognitive structures. Jacob

based on holistic principles fosters active integration of learning and deepens an understanding

of complex systems and behaviors. In unpredictable and complex digital systems, reflection and

‘soft systems thinking’ encourage intellectual humility. Elmelhem et al. (2018) amplify this by

cybersecurity problems as dynamic patterns, rather than in isolation. These findings converge to

show that the holistic paradigm strengthens cognition and transforms professionals in

cybersecurity into strategic thinkers, equipped to tackle uncertainty with explicit and advanced

control.

Sustainability in cybersecurity can be realized through holistic practices integration at an

18

mechanisms within the maturity models ensures that cybersecurity undergoes development in

parallel with changing landscapes in the environment and technology. This institutional

the alignment of cybersecurity sustainability to the overarching economic efficiency. Choras et

al. (2015) notes comprehensive resilience models balance proactive and reactive approaches and

in doing so, significantly reduce systemic fragility. Collectively, these studies suggest that in

cybersecurity, static protection does not lead to sustainability. Rather, it is through cultural and

practices.

Integrating a holistic model builds ethical accountability in managing cybersecurity. As

noted by Garcia et al. (2017), governance frameworks based on holistic principles foster

means that ethics become part of the foundation of resilience. As noted by Jacob et al. (2019),

the inclusion of interdisciplinary approaches brings moral complexities to the forefront of

technical decision-making, thus ensuring that the cybersecurity frameworks will be implemented

without infringing upon the privacy and civil liberties of individuals. This ethical reflexivity and

moral reasoning mitigate the risk of overreach that comes with the surveillance-focused

defensive model. In support of this view, Barclay (2014) argues that progression through the

19

capability maturity model should be based on the responsible evolution of security, whereby

ethical performance is a maturity indicator alongside technical refinement. This ethical

foster a digital environment that is secure and instills trust.

Employing a holistic approach to cybersecurity encourages self-regulating resilience

(2018) asserted that organizations can detect and respond to threats coordinated synchronically

and cohesively when the integrated active triad of a technology-people-process system is present.

This coordinated response minimizes system accumulation and maximizes continuity. Marotta

uncertainty permit organizations to learn in real time from disruptive events. The empathy

argument for holistic cybersecurity depicts it as an evolving ecosystem, an intelligent and

adaptive organism that thrives not by resisting change, but by continuously improving.

Implementing a Holistic Cybersecurity Strategy

20

Building a strong cybersecurity strategy begins with developing a comprehensive risk

management framework that will cover the organization's unique aspects. Kumar et al. (2021)

requirements-tailored risk management plan serves as the foundation for an integrated

cybersecurity program, aligning with the organization's objectives and risk tolerance. Al-Sartawi

(2020) affirms the above, stating that it enables making informed decisions on security measures

and control points after the risk analysis. It is a data-driven approach that replaces crisis-oriented

implementing holistic and sustainable cybersecurity systems.

investment in people and the creation of a culture of security consciousness. According to

Demirkan et al. (2020), we should initiate comprehensive training programs and raise awareness

across the entire organization to ensure every employee, regardless of level, can identify and

prevent these threats. As well, the organizations need to build up a culture where cybersecurity is

a shared responsibility, supportive of open communication, collaboration, and a proactive

mindset for breach identification and mitigation (Hasan et al., 2021). A culture of security

21

awareness decreases the risks of human error and insider threats. Employees' ownership of their

roles is an active line of defense in the battle against cybersecurity attacks (Kumar et al., 2019).

strength.

the human factor, which is vital to cybersecurity resilience. Organizations should be

implementing a comprehensive cybersecurity strategy, which would involve not only technical

measures but also robust risk management, continuous training and awareness, and a culture that

and technology in a coordinated way, the enterprises can be able to comprehensively manage the

risks and build a strong cybersecurity position. The effectiveness of the current strategies of the

organizations will be measured, and they will have to adopt a holistic approach to guarantee

long-term security against cyber threats that are always developing.

Devising a comprehensive cybersecurity strategy involves integrating defense objectives

22

importance of embedding cybersecurity governance into the corporate structure involves

responsibility and the synchronization of protection objectives with the primary business strategy

organizational structure imposes and deteriorates security across large enterprises. Additionally,

Boehm et al. (2018) explain that the incorporation of cyber risk estimation into governance

facilitates the making of trade-off decisions per organizational goals. This approach allows the

transformation of cybersecurity from a technical task to a strategic business function. Proper

making cohesion.

The development of cybersecurity resilience entails adopting adaptive mechanisms that

organizations can implement multi-faceted educational frameworks in order to create iterative

feedback loops that help organizations respond to changes in threat landscapes. With threats that

continuously evolve, organizational employees and technical staff will benefit from continuous

adaptive learning. A more dynamic training model will promote agility in organizational

personnel and reduce dependence on static compliance-based awareness. Elmelhem, Bouras, and

Ghemri (2018) stress that comprehensive structural frameworks in organizations embed

23

experiential learning and, therefore, promote the connection of employees’ theoretical

knowledge frameworks to crisis response. Experiential learning in such frameworks offers

create innovative counter-defensive measures.

organizations to assess and apportion resources in a manner that focusses on the most important

and most risky weaknesses. That said, quantitative risk models will never fully replace the value

of judgement. Context of the business may be lost in the risk assessments generated by

human input, which is why, in the eyes of Carcary, Doherty and Conway (2019), automated

systems and human input, are to be integrated for the most balanced and justifiable decision

making in cybersecurity. In a similar way, Meinig et al. (2019) posit that strategy-based threat

modeling approaches these technologies along with the systems automation in a comprehensive

manner to ensure that automation supports rather than overshadows strategic intent. Data-based

assessments coupled with managerial input enables a system to maintain the level of strategy

24

adaptability. In comprehensive systems, automation is to reinforce human accountability, not

replace it.

Any sustainable cybersecurity strategy includes transformational culture change that

espouses common values and collective citizenship. Kohnke (2016) argues that linking job

functions within an organization to cybersecurity competencies allows every employee to

appreciate how their role fits within the defense architecture. This integration redefines

cybersecurity as the goal of collaboration rather than the focus of a single institution. Dawson

controls. When people embrace security as part of their identity, organizations attain a level of

resilience that no tool or policy, standing alone, can achieve.

Matania, Yoffe and Mashkautsan (2016) argue for the need of multilevel cooperation among

public and private actors. Such an approach takes cybersecurity beyond a closed system and

views it as an ecosystem. Rapid collective defenses and early warning of threats to an entire

domain are possible through collaborative sharing of information. Strengthening national level

cyber defenses through shared threat intel and aligned standards is a cross-sector collaboration

25

alliance of this sort extends protective boundaries far beyond the organization’s internal

perimeter. Elmelhem et al. (2018) observe that cooperative security frameworks provide

provided both are pursued in stride, which ensures that neither innovation nor a cyber-threat

mitigation measure is deployed out of synchrony. As reported by Boehm et al. (2018) making

cyber risk assessment an integral element at every digital tier of a project allows the

blocker. An amalgamation of innovation and cyber defense is vital to maintain the

transformation project’s sustenance. These unifying strategies are the nexus that weaves the

fragmented facets of advancement and defense together, permitting disruptive technologies to be

crafted in a well-regulated and sheltered setting.

Implementation of holistic cybersecurity must incorporate measurement and continuous

32

cyber skills, intensify the phenomenon of shared accountability that emerges from the cyber team

identity. This means that the notion of cybersecurity needs to be constructed as a social

secure behaviors, even in stressful situations.

challenges. Complex educational approaches as Wei et. al (2016) describes, gamified strategies

have better effectiveness in serving diverse learning needs. This, in turn, enhances inclusion and

retention. Carcary et. al (2019) show that feedback and social recognition integrated with

behavior are put in a playful manner, and as such, much easier to adopt and maintain. This is

very true for the gamified approach which minimizes the psychological gap between an action

and an awareness of it; it enables an active participation. When used along with other

approaches, deliberately and thoughtfully applied, it enhances enduring, effortless attention and

strengthens omnipresent self-discipline.

33

The problem with risk cognition explains why users tend to make irrational decisions

regarding cybersecurity. McAlaney et al. (2016) point out that individuals tend to arrive at

disciplinary cyber security training. Patterson and Winston-Proctor (2019) advocate for training

programs that immerse users in realistic phishing and other deceptive situations to enhance

emotional resilience and situational awareness. Such training prepares individuals to identify and

thwart manipulation in advance of its execution. By focusing on emotions and irrational

thinking, organizations ready users for exploitation, turning psychological gaps into an defense.

Understanding one’s actions on a computer is the result of a complex interplay of

behavioral science, company dynamics and technology. According to Meinig et al. (2019),

predictions for the chances of a breach occurring are more accurate when human behavioral

the merging of psychological thinking and engineering thinking, and further solidifies the

argument that computer science is a field that encounters social and technical aspects. Instead,

the reaction is given to the suggestion made by Carcary et al. (2019), that policies which are

human centered are improved by the feedback created from surveys, performance metrics, and

cultural audits. This understanding of a problem amplifies operational intelligence by adding

behavioral insight. The work of Montasari et al. (2018) stresses that controls may need to be

34

changed in order to mitigate risks in cases when adaptive systems are able to learn from

behavioral patterns of people. These perspectives shift the view of computer science from

resilience. Strategies also change because they are the very people that such tactics are aimed at.

Integrating Cyber Ethics and Digital Responsibility Frameworks

The strategic incorporation of cyber ethics within an organization begins with the

assertion that every technological decision is a decision of morality. As highlighted by

Elmelhem, Bouras, and Ghemri (2018), the social and human effects of cyber and information

systems should be ethically foresighted during the systems design stage. This placement of cyber

security design and systems within the moral frame of social trust and justice, and not merely a

technical frame, expands the ethics of cyber security beyond the traditional defensive posture of

cyber walls. When systems are designed with ethical reasoning, the risk of systemic bias and

harm in the name of efficiency is removed. Sustainable security advantage is, as Barclay (2014)

puts it, a by-product of the moral responsibility embedded in the governance systems of a

by Taitto, Nevmerzhitskaya, and Virag (2018) illustrates that ethics based decision making is

also enhanced through simulation environments with ethical frameworks where teams can

interact with the consequences of their actions on the morality of the situation. All of these

innovations and strategies seem to indicate that the relationship with ethics in modern businesses

is increasingly moving from compliance to conscience, and is increasingly woven into the

technical and management systems of an organization.

35

The Newhaven Institute for Cyber Security Ethics identifies three principal theories of

philosophy that underpin the discipline of cyber security ethics as deontology, consequentialism

Consequentialist ethics as a technique of problem solving, however, bare the ethical practitioner

with formidable challenges. Ethical practitioners are accomplices to their own demise. The

dilemma of outcome driven ethics is the propensity to justify ethics of covert and intrusive

surveillance plus excessive and disproportionate retribution of countermeasures. Barclay (2014)

organization and the ethical practitioner of the discipline.

The erosion of privacy is at the center of the ongoing tension between surveillance and

democracy with regard to algorithmic governance and modern cybersecurity issues. According to

Elmelhem et al. (2018), the user safety and user intrusion boundary has been increasingly blurred

due to the automated user behavior monitoring systems. This ethical paradox is not

straightforward and needs solutions that accommodate both the national security and civil liberty

36

frameworks. Ani et al. (2017) claim that lack of oversight on critical infrastructure monitoring

can result in an erosion of public trust and an unreasonable concentration of power. Distrust is a

With justified social consequences, digital privacy can be achieved through reflection on social

behavior, and not the technology that has been created in a democracy. This is the boundary

between `responsible security` and `timid democracy`. It is the commitment to designing systems

that center privacy and social ethics are critical for an actor to be considered a democracy.

dimensions within organizations. Henshel et al. (2016) argue that integrated risk quantification

models should include ethical constructs such as social harm and data justice, in addition to the

traditional financial exposure paradigm. The underlying premise here is to reframe risk in

(2018), risk management driven by ethical considerations undertaken in an anticipatory fashion

serves to avert a reactive response to a crisis, thereby promoting clarity and openness in the

decision-making process. This ethical dimension integrates a technical form of thinking with an

impact on humanity. In strong support of this view, Barclay (2014) posits that the maturing of

ethical thinking improves the level of an organization’s capability, thus supporting the alignment

of the quest for a security advantage with the level of public trust. The ethical quantification of

37

risk changes its management approach to a more complex, multi-dimensional one, requiring a

balance between precision and compassion. Organizations that incorporate moral reasoning

The ethical concerns posed by AI-powered defense systems are unique. Nhwenya et al.

(2019) articulate how AI ‘monitoring and threat prediction’ tools are trained on biased data and

how this can perpetuate systemic inequity. It raises the concern of automated decision systems’

moral judgment cannot be automated. The ethics of AI must instead be emphasized as a

governance oversight, the constant supervisory mechanism in which a specific innovation is

implement, and operate the defended systems. Rege (2015) points out that the use of experiential

learning models in the teaching of cybersecurity encourages moral sensitivity by placing students

in ethically challenging positions. Such approaches foster empathy, critical analysis, and ethical

reflexes which are needed for exercising leadership in digital spaces. According to Elmelhem et

al (2018) a holistic ethical education framework enables cybersecurity practitioners to function

38

framework. It is therefore no longer sufficient to possess only technical skills. Ethical literacy

also becomes a primary constituent. Ngwenya et al. (2019) propose that ethical role modeling

Maturity Model has the potential to embed ethical accountability at different cooperation levels

between countries, ultimately fostering sustainable collaboration. This ethical reciprocal ensures

that technology is not overused. As noted by Marotta and McShane (2018), international

structural power. Collective ethical defense is resilient moral defense, which suggests that ethical

convergence is a form of defense. Coordinated cyberspace defense as well as technology requires

trust, shared ethics, and not just armament. Every model of a corporation’s governance should

consider ethical digital conduct a strategic asset. As Barclay (2014) claims, the relationship

between ethical governance and innovation helps the organization improve in terms of

adaptability.

39

Instant credibility and reputation make investors, partners, and consumers easily

accessible. Trust is the new currency. As emphasized by Elmelhem et. al (2018), auditing every

with stakeholders. In such a governance model, the organization is able to change its perception

of cyber security from an expense that is defensive to one that is strategic. Ethical governance,

when enacted through engineering, helps organizations build both technical and reputational

resilience.

on cybersecurity are as important as the issue of public security of the country as public as

exemplified by Ani et al. pleas around the severe breach of infrastructural boundaries and the

public safety (2017). The consequences of cyber negligence are physical as well as moral.

from IT issues to the ethics and welfare of the society. Henshel et al. (2016) in their works argue

that sub–classes of social harms ought to be included in the models of risk evaluation to help

policymakers internalize the need for moral responsibility in restoration to operational recovery.

This strategy and any strategy for that matter places in the open and square the fact that post–

cyber incident victims are human and part of the discourse and not merely the passive target of

decision making. It echoes the argument of Marotta and McShane that in the current society,

40

organizations that are empathetic and practice ethical behavior during crises, stand better chances

of gaining public confidence when restating the value ethos of the organization in the narrative.

technological development, Barclay (2014) proposes strategic ethical proxies which are similar

to the approach used in adaptive cycles of technological development. Revamping proxies

ensures that ethical consideration development keeps in pace with technological iteration. To

be used to assess the societal implications of technologies such as biometric identification

systems or AI surveillance prior to deployment. Underpinned by moral imagination, these

protective ethics mechanisms are adaptable anticipative governance strategies Stemming from

these arguments, ethical frameworks accompanying technological advances should help or

promote more than regulate or restrain. Progress in technology should resonate with the best

attributes of humanity and not merely with the faster attributes.

41

Strengthening Cybersecurity Governance Through National and Global Policy Integration

At the national level while designing and implementing policies and coordinating the

administrative system on the governance level, policies and technologies are ascribed most

efficiently. Mature national frameworks, according to Tatar, Karabacak and Gheorghe (2016),

constitutional cyber risk management as an integral part to and on the same plane as the national

public Administration framework and system owing to its interwoven and interlinked nexus, and

not as a silo-ed constituent. Such integration assures continuity, as well as accountability and

highlight the same conclusion, which is policy governance marshalls unity with flexible

administrative frameworks, while multi geo political and technical structures policies need

the world in the digital age. According to Greiman (2015), because of the nature of cyber threats,

isolated national defense policies are no longer useful, and governance frameworks must focus

on international collaboration. This interdependence demonstrates the common weakness of

modern interconnected economies. Sutherland (2018) goes on to explain that global governance

instruments, such as international treaties and agreements, are fundamental in establishing global

48

the systems thinking model. Treating the social system as a subsystem of the technical system

within which a social system exists. In cybernetic systems thinking, Heisenberg's uncertainty

numerical risk matrices can reduce very complicated relationships to a simple level that misses

the potential for cascading failures and errors of omission and commission by people. Antikainen

(2014) advocates for the use of information fusion techniques to enhance the qualitative

in such fused models create composite indicators that can be used to monitor ever evolving threat

environments. Over reliance on qualitative indicators such as numerical scores can be and often

is a case of false precision. True integrity indicators of cyber resilience come from constructing a

balance between qualitative and quantitative measures. Therefore, metrics need to change from

rigid numbers to responsive elements that determine real time strategic moves.

49

The complements of qualitative evaluation attend to behavioral and cultural aspects of

cybersecurity. As Suresh (2018) points out, analyzing how people cope in a crisis sheds light on

the qualitative insights point out assessment gaps in the reliability of a system and the

corresponding adaptability of a person. Motivation, culture, and perception of qualitative metrics

by the organization shift measurement from a mechanical form of auditing to learning.

diverse indicators, technical, processual, and human, creates a unified resilience index that can

serve both national and corporate governance. Composite indices bring different indicators and

data streams to a single analytical and evaluative perspective. Taitto, Nevmerzhitskaya and Virág

anticipate and identify systemic weaknesses before the onset of a crisis. Such models serve as

ethical and operational testing laboratories. According to Salim (2014), systems composite

indices depict interdependency and interrelation of organizational processes and therefore,

prevent silo thinking. Thus, the use of composite indices improves the decision-making process

in the organization by converting data to knowledge that can and should be acted upon. The

50

diverse indicators, through synergy, create a single unified, coherent and interrelated narrative of

resilience that allows for strategic wisdom.

The development of evidence-based cybersecurity governance now includes considering

the importance of key performance indicators (KPIs) as critical evidence tools. Ali and Jali

(2018) note that it is important to integrate KPI targets to different organizational levels so that

every investment made into a security resource system is aligned to a strategic outcome. This

change enables the transformation of cyber security investment from a loss to a value gaining. As

compliance defined, are the most critical components to effective performance evaluation, to

remind oneself that the measures are there to be performance indicators, rather than performance

corporate cyber security systems (Tabatabaei & Wells, 2017). OSINT frameworks enhance

situation awareness through the analysis of emerging threats backed by publicly available data,

which improves the pre novice cyber defenses (Antikainen, 2014). Amongst the multitude of

open and freely available cyber threat intelligence, OSINT derived indicators seamlessly

integrated within cyber resilience frameworks improve responsiveness by uncovering weak

51

OSINT based monitoring in industrial settings reveals critical supply-chain vulnerabilities that

remain undetected by internal audits. These case studies present the notion that external

show how organizations can change controls in real time. Suresh (2018) asserts that metrics that

quantify incidents during training greatly improve people-centric crisis management. These

adaptable processes are what demonstrate that metrics are relevant in the changing worlds of

ability to learn, anticipate, and improve through introspective analysis. Such metrics demonstrate

that the organization has attained learned resilience. In this case, resilience is the purely defined

the feedback score cut through the adaptation cycle.

Across critical sectors of infrastructure, accuracy is one of the cornerstones of reliability

and safety. In manufacturing, Ani et al. (2017) articulates the importance of stringent auditing

52

(2014) notes that resilience models that include indicators of operational continuity perform

better along the fusion of digital and physical protective layers. Salim (2014) defends the notion

innovation, to a strategic facilitator.

According to Salim (2014), systems thinking reveals the unintended negative outcomes that

poorly constructed criteria can have on the policies that center ethical performance in their over-

optimizing policies. Taitto et al. (2018) demonstrate the use of ethical composite indicators

technologies. Their approach to ethical evaluation, when integrated with measurement systems,

ensures the ethical alignment of societal progress with technological advancement. Having

ethical frameworks transforms cybersecurity from a functional technicality to its moral essence

of fairness and transparency. Organizations that measure responsibility and risk emerge with

intact systems and unassailable societal legitimacy.

53

Integrating metrics with human performance remains crucial for evaluation purposes.

Suresh (2018) states success in crisis management requires rational alignment of capabilities

agency. When metrics represent which people truly believe and perform under pressure,

confidence and accountability within the whole organization increases. Bridging human

psychology with analytical precision turns performance evaluation to a relationship between

thought and computation.

refining metrics in cybersecurity. According to Taitto et al. (2018), virtual simulation

environments enable scholars to assess how different measurement frameworks work prior to

their deployment in the actual world. These simulation-based studies help determine how various

cybernetics enhances predictive assessment through simulation by pinpointing failure and

interdependence. Antikainen (2014) advocates for the inclusion of information fusion at basic

levels of simulation in order to augment data for performance assessment. Such approaches

transform the formulation of concepts and positions into practical ways of reflecting on and

simulating the phenomena. Within certain limits, organizations may adjust and fine-tune their

pre-crisis threshold indicators by simulating measurement pressures. In this regard, simulation

54

casts evaluation in the light of multifaceted experimentation, rather than unidimensional

hindsight, thus enhancing both precision and flexibility.

Establishing some level of standardized but flexible metrics is important for a country’s

cybersecurity resiliency. In her work, Antikainen (2014) develops a model that describes the

integration of national information systems with local feedback loops for real-time awareness at

all governance levels. Such integrated measurement frameworks enhance support for

transparency and coordination. As per Salim (2014), systems-based national metrics

become governing instruments that enable policymakers to ensure a level of security while

fostering innovation.

owned and answerable to by users and managers as well as the technical team when employees,

policymakers, and technical teams are integrated in the design of the performance metrics. The

measurement processes are more transparent as suggested by Tabatabaei and Wells (2017) when

open intelligence approaches are used in the assessment. Ngwenya et al. (2019) highlight that

self-analysis platforms that support collaborative monitoring of the activities self-analyzed

55

These models of participation in governance and design give ownership of the security

participatory paradigm and evaluation marks a change to distributed ownership from control.

measurable through compliance, context, and collective commitment.

Balancing Artificial Intelligence, Automation, and Human Oversight in Cyber Defense

The field of machine learning (ML) has enabled the automation of mundane and complex

tasks across several domains. For example, Henshel et al. (2016) emphasize the importance of

machine learning-based automation and its effectiveness in enhancing the precision of modelling

cyber risks by processing large datasets. Studies such as Morris and McShane (2018) have

showcased the increased diffusion of cyber threats because of the speed at which threats are

responded to. Such studies emphasize the importance of balance, as backward and forward

planning, when structuring the approach to incident response. Today, integrated cyber security

measures are more effective paired with human oversight (e.g. automated cyber security

learning. As such, the most defendable environments are those in which there is a synergy of

effectively identify evolving attack signatures, even in the absence of prior knowledge of

associated attack patterns. This flexibility enables unsupervised models to modify their formation

56

defense to novel threats in real time. Nevertheless, Jacob, Peters, and Yang (2019) remark that

algorithmic learning has a propensity to generate high false positive rates, which defies the

most effective.

al. (2016) remarked that having interpretable models enhances the confidence of the stakeholders

because the decision-makers are able to follow through the reasoning of the algorithms on which

particular outcomes are produced. This also aids in the auditing and compliance to regulations.

automated defense systems, as a means of ensuring that the reasoning of the algorithms remain in

line with the ethical values of the institution. All these show that the efficiency of AI is as much

dependent on the capability as it is on the clarity. Explainability changes artificial intelligence

from a non-collaborative technology to an integrated partner in the governance of the overall

risk, thus, enhancing accountability and the trust.

57

The emergence of adversarial AI has made cybersecurity more complex as it transformed

algorithms into instruments as well as objectives of attacks. Choras et al. (2015) contend that

the combination of human red‐teaming and automated systems in a defense posture reveals gaps

that automated frameworks miss. All these studies emphasize the fact that AI defense must

consider intelligent adversaries that would seek to exploit its underlying logic. Effective cyber

defense thus requires not just intelligent algorithms but also interdisciplinary imagination that

predicts and addresses potential circumventions.

The level of automation permitted in Security Operation Center(s) (SOCs) has changed

the entire domain of response management. As Marotta and McShane (2018) noted, integrating

automated, AI-driven triage to the first level of response and alerting systems significantly

rewarding aspects of the task. This changed division of labor optimizes the system and reduces

fatigue. On the other hand, Henshel et al. (2016) suggest that too much automation can result in

the lack of situational awareness. Analysts disengaging from the operational detail of processes

may lose the context of the system. Jacob et al. (2019) suggest that hybrid models of SOCs can

be optimized so that automated systems do the pattern recognition and human analysts do the

higher-order strategy thinking. This kind of integration ensures that the human decision making

64

Ali, F. A. B. H., & Jali, M. Z. (2018, May). Human-technology centric in cyber security

maintenance for digital transformation era. In Journal of Physics: Conference

32-74.

Antikainen, J. (2014). Model for national cybersecurity resilience and situation awareness

improvement: An information quality–centric approach leveraging fusion of established

practitioner and academic disciplines.

Atoum, I., Otoom, A., & Abu Ali, A. (2014). A holistic cyber security implementation

framework. Information Management & Computer Security, 22(3), 251-264.

Barclay, C. (2014, June). Sustainable security advantage in a changing environment: The

Cybersecurity Capability Maturity Model (CM 2). In Proceedings of the 2014 ITU

kaleidoscope academic conference: Living in a converged world-Impossible without

standards? (pp. 275-282). IEEE.

65

Carcary, M., Doherty, E., & Conway, G. (2019, July). A framework for managing cybersecurity

effectiveness in the digital context. In European Conference on Cyber Warfare and

Choras, M., Kozik, R., Bruna, M. P. T., Yautsiukhin, A., Churchill, A., Maciejewska, I., ... &

Jomni, A. (2015, August). Comprehensive approach to increase cyber security and

resilience. In 2015 10th International Conference on Availability, Reliability and

Dalal, R. S., & Gorab, A. K. (2016). Insider threat in cyber security: What the organizational

psychology literature on counterproductive work behavior can and cannot (yet) tell us.

of Human Social Behavior (Doctoral dissertation, Carnegie Mellon University, USA).

Dawson, M. (2018). Applying a holistic cybersecurity framework for global IT

organizations. Business Information Review, 35(2), 60-67.

Demirkan, S., Demirkan, I., & McKee, A. (2020). Blockchain technology in the future of

business cyber security and accounting. Journal of Management Analytics, 7(2), 189-208.

Elmelhem, J., Bouras, A., & Ghemri, F. (2018, December). Towards a Holistic Approach of

Cybersecurity. In 2018 3rd Technology Innovation Management and Engineering

Science International Conference (TIMES-iCON) (pp. 1-4). IEEE.

66

Galinec, D., Možnik, D., & Guberina, B. (2017). Cybersecurity and cyber defence: national level

strategic approach. Automatika: časopis za automatiku, mjerenje, elektroniku,

Garcia, M., Forscey, D., & Blute, T. (2017). Beyond the network: A holistic perspective on state

cybersecurity governance. Neb. L. Rev., 96, 252.

Greiman, V. A. (2015). Cybersecurity and global governance. Journal of Information

Warfare, 14(4), 1-14.

globalized (in-) security and sociotechnical visions of the digital society. Österreichische

Hasan, S., Ali, M., Kurnia, S., & Thurasamy, R. (2021). Evaluating the cyber security readiness

May). Modeling cybersecurity risks: Proof of concept of a holistic approach for

Hohmann, M., Pirang, A., & Benner, T. (2017). Advancing Cybersecurity Capacity

Building. Global Public Policy Institute (GPPi).

67

Jacob, J., Peters, M., & Yang, T. A. (2019). Interdisciplinary cybersecurity: Rethinking the

approach and the process. In National Cyber Summit (pp. 61-74). Cham: Springer

Kohnke, A. (2016, October). A Holistic Approach to Cybersecurity: Mapping the NICE

Workforce Framework to the Critical Infrastructure Cybersecurity Framework.

Kumar, S., Biswas, B., Bhatia, M. S., & Dora, M. (2021). Antecedents for enhanced level of

cyber-security in organisations. Journal of Enterprise Information Management, 34(6),

management approach. Risk Management and Insurance Review, 21(3), 435-452.

Matania, E., Yoffe, L., & Mashkautsan, M. (2016). A three-layer framework for a

comprehensive national cyber-security strategy. Geo. J. Int'l Aff., 17, 77.

McAlaney, J., Taylor, J., & Faily, S. (2016). The social psychology of

cybersecurity. Psychologist, 29(9), 686-689.

Meinig, M., Sukmana, M. I., Torkura, K. A., & Meinel, C. (2019). Holistic strategy-based threat

model for organizations. Procedia Computer Science, 151, 100-107.

68

Ngwenya, T. M., Elleh, F., McKoy, C., Lloyd, F., Kemp, R., Carrillo, R., ... & Cochran, T.

(2019). Self-Analysis Technology, Roles, and Cybersecurity in the Virtual Learning

Patterson, W., & Winston-Proctor, C. E. (2019). Behavioral cybersecurity: Applications of

Rege, A. (2015). Multidisciplinary experiential learning for holistic cybersecurity education,

research and evaluation. In 2015 USENIX Summit on Gaming, Games, and Gamification

67.

Salim, H. M. (2014). Cyber safety: A systems thinking and systems theory approach to managing

cyber security risks (Doctoral dissertation, Massachusetts Institute of Technology).

Shackelford, S. J., & Craig, A. N. (2014). Beyond the new digital divide: Analyzing the evolving

Suresh, P. K. (2018). People centric cyber crisis management.

69

Tabatabaei, F., & Wells, D. (2017). OSINT in the Context of Cyber-Security. Open Source

Intelligence Investigation: From Strategy to Implementation, 213-231.

Taitto, P., Nevmerzhitskaya, J., & Virag, C. (2018). Using holistic approach to developing

cybersecurity simulation environments. In The International Scientific Conference

eLearning and Software for Education (Vol. 4, pp. 77-84). " Carol I" National Defence

Tatar, U., Karabacak, B., & Gheorghe, A. (2016, March). An assessment model to improve

national cyber security governance. In 11th International Conference on Cyber Warfare

Systems, 35(1), 155-186.

Wei, W., Mann, A., Sha, K., & Yang, T. A. (2016, September). Design and implementation of a