Enabling cybersecurity incident response agility through dynamic capabilities: the role of real-time analytics

ABSTRACT

We explore how organisations enable agility in their cybersecurity incident response (IR) process by developing dynamic capabilities using real-time analytics (RTA). Drawing on RTA practices in the IR process at three large financial organisations, we develop a framework to explain how IR teams respond to the rapidly evolving cyber threat environment by developing RTA-based microfoundations that underpin the building of sensing, seizing, and transforming dynamic IR capabilities. These dynamic IR capabilities in turn help organisations to enable agility in their IR processes by leveraging swift, flexible, and innovative IR strategies, including active threat reconnaissance, active threat defence, and pervasive learning. Our findings have implications for the discourse on cybersecurity because we demystify the black box of IR agility, for our understanding of the use of RTA to enable agility in IR, and for the discourse on dynamic capabilities.

KEYWORDS:

• Real-time analytics
• cybersecurity
• incident response
• agility
• dynamic capabilities

Disclosure statement

No potential conflict of interest was reported by the author(s).

Notes

1. Some of the informants used additional tools such as whiteboard/marker, pen/paper, and posters already displayed in the interview space to further elaborate their responses. We photographed this supplementary material after seeking consent.