We explore how organisations enable agility in their cybersecurity incident response (IR) process by developing dynamic capabilities using real-time analytics (RTA). Drawing on RTA practices in the IR process at three large financial organisations, we develop a framework to explain how IR teams respond to the rapidly evolving cyber threat environment by developing RTA-based microfoundations that underpin the building of sensing, seizing, and transforming dynamic IR capabilities. These dynamic IR capabilities in turn help organisations to enable agility in their IR processes by leveraging swift, flexible, and innovative IR strategies, including active threat reconnaissance, active threat defence, and pervasive learning. Our findings have implications for the discourse on cybersecurity because we demystify the black box of IR agility, for our understanding of the use of RTA to enable agility in IR, and for the discourse on dynamic capabilities.

Organizations are at risk of cyber-attacks more than ever before due to the ongoing digitalization of business operations. Industry reports indicate that it is not a matter of if but when organizations become victims of cyber-attacks or breaches. In this research, we argue that organizations must enable agility in their incident response (IR) to quickly respond to diverse cybersecurity threats, and big data analytics (BDA) plays a pivotal role in enabling agility in the IR. Drawing from dynamic capabilities theory, we conducted a field study using a case study approach to examine the following research question: What dimensions of big data analytics-embedded dynamic capabilities enable agility in cybersecurity incident response? We develop a framework that presents five key dimensions of BDA-embedded dynamic capabilities (data consolidation, threat intelligence, incident investigation, analytical skillset, and cybersecurity analytics warehouse) in IR at four specific stages, that is, manual analysis, basic analytics, advanced analytics, and pervasive analytics. The detail of the framework explains how BDA-embedded dynamic capabilities at the pervasive analytics stage enable agility in IR by infusing agile characteristics of flexibility, speed, and learning in IR. This study contributes to the knowledge of IT-embedded dynamic capabilities and cybersecurity IR agility. Detailed recommendations are also provided for potential practitioners.

Abstract Digital assets of organizations are under constant threat from a wide assortment of nefarious actors. When threats materialize, the consequences can be significant. Most large organizations invest in a dedicated information security management (ISM) function to ensure that digital assets are protected. The ISM function conducts risk assessments, develops strategy, provides policies and training to define roles and guide behavior, and implements technological controls such as firewalls, antivirus, and encryption to restrict unauthorized access. Despite these protective measures, incidents (security breaches) will occur. Alongside the security management function, many organizations also retain an incident response (IR) function to mitigate damage from an attack and promptly restore digital services. However, few organizations integrate and learn from experiences of these functions in an optimal manner that enables them to not only respond to security incidents, but also proactively maneuver the threat environment. In this article we draw on organizational learning theory to develop a conceptual framework that explains how the ISM and IR functions can be better integrated. The strong integration of ISM and IR functions, in turn, creates learning opportunities that lead to organizational security benefits including: increased awareness of security risks, compilation of threat intelligence, removal of flaws in security defenses, evaluation of security defensive logic, and enhanced security response.