Enabling cybersecurity incident response agility through dynamic capabilities: the role of real-time analytics
研究了三家大型金融机构如何利用实时分析技术构建动态能力，从而提升网络安全事件响应的敏捷性，包括主动威胁侦察、防御和持续学习策略。
We explore how organisations enable agility in their cybersecurity incident response (IR) process by developing dynamic capabilities using real-time analytics (RTA). Drawing on RTA practices in the IR process at three large financial organisations, we develop a framework to explain how IR teams respond to the rapidly evolving cyber threat environment by developing RTA-based microfoundations that underpin the building of sensing, seizing, and transforming dynamic IR capabilities. These dynamic IR capabilities in turn help organisations to enable agility in their IR processes by leveraging swift, flexible, and innovative IR strategies, including active threat reconnaissance, active threat defence, and pervasive learning. Our findings have implications for the discourse on cybersecurity because we demystify the black box of IR agility, for our understanding of the use of RTA to enable agility in IR, and for the discourse on dynamic capabilities.