Research synthesis · Cybersecurity

Cybersecurity as a decision-making, organizational and educational problem

Vajjhala and colleagues treat cyber risk as a problem of decision-making, organizational behaviour and education as much as technology: most major attacks exploit missed warnings, unpatched systems and insecure contractors, awareness and compliance depend on social, cultural and organizational factors, and the research literature on talking face generation has so far built in almost no safeguards against deepfake misuse.

A short narrative review of research by Narasimha Rao Vajjhala and co-authors in this area. Every claim carries an APA citation that links to the publication’s own page (abstract, key findings, DOI); the full references are listed at the end. Updated .

Synthesis

Narasimha Rao Vajjhala’s cybersecurity research treats cyber risk as a problem of decision-making, organizational behaviour and education as much as of technology. In an analysis of 25 major cyberattacks between 2020 and 2022, Strang and Vajjhala (2023b) found that extortion was the most common motive (44%), followed by service disruption (32%) and data theft (24%), and that 36% of attacks involved bitcoin ransom. They traced many incidents to missed warnings, unpatched or unmonitored systems, insecure contractors and insecure software updates, and recommended regular log audits, prompt patching, scanning of software updates, awareness training, contractual cybersecurity clauses and intrusion detection systems.

The group has also shown how machine learning can make cyber risk measurable. Strang and Vajjhala (2024b) applied t-SNE, radial analysis and correspondence analysis to hypertext extracted from about 848 US higher-education website records, containing over 4,000 potential security indicators, and scored each institution’s breach likelihood on a 1–3 scale; a combined control feature was the most useful signal for flagging very high-risk components. Olaniyan et al. (2023) positioned user and entity behavioural analytics as an AI approach for discovering where attacks originate and recommending responses to organizational decision-makers.

A distinctive strand of the work concerns the human and cultural context of security. Nasir and Vajjhala (2020) argued that low information security awareness and compliance in sub-Saharan Africa are only partly explained by Internet penetration, infrastructure, literacy and technology costs, and that behavioural, social, cultural and organizational factors are neglected by a literature centred on developed countries; they set out an interpretivist multisite design covering 50 managers in 20 Nigerian firms. On the education side, Strang et al. (2020a) found only five peer-reviewed papers on teaching blockchain and proposed a two-dimensional typology — from programmer to managerial decision-maker, and from theoretical to hands-on teaching — concluding that blockchain is an essential part of modern cybersecurity education.

Generative AI extends this agenda to synthetic media. Reviewing 92 talking face generation studies published between 2016 and 2025, Salahudeen et al. (2026) found that only one system embedded any technical safeguard — a post hoc watermark that was not C2PA-compliant — and that none implemented consent or provenance, although EU AI Act Article 50 transparency obligations for synthetic content have applied since 2 August 2026. They proposed the RTFG-STS Framework, which combines cryptographically signed C2PA provenance with risk-tiered consent, a deepfake detectability audit and human oversight, as a research construct for deploying the technology responsibly in identity management and other socio-technical systems.

Vajjhala has extended this agenda through edited volumes aimed at practitioners and policymakers: evidence-based strategies for managers and policymakers (Vajjhala & Strang, 2023), the protection of organizational knowledge assets through AI-based detection, malware classification and insider-threat cases (Vajjhala & Strang, 2025), and AI-enabled threat intelligence and cyber risk assessment (Martiri et al., 2025).

The common conclusion is that organizations reduce cyber risk most reliably by combining technical controls with informed decision-makers, security-aware cultures and curricula that prepare both technical and managerial graduates.

Key claims with sources

  1. Of 25 major cyberattacks in 2020–2022, 44% were extortion, 32% service disruption and 24% data theft; 36% involved bitcoin ransom (Strang & Vajjhala, 2023b).
  2. Unsupervised machine learning on hypertext from about 848 US higher-education website records can score breach likelihood (Strang & Vajjhala, 2024b).
  3. Low information security awareness in sub-Saharan African SMEs is only partly explained by infrastructure, literacy and cost (Nasir & Vajjhala, 2020).
  4. Of 92 talking face generation studies published in 2016–2025, only one embedded any technical safeguard, and none implemented consent or provenance (Salahudeen et al., 2026).

The publications and what each contributes

PublicationMethodCore finding or contribution
Salahudeen et al. (2026)
Systems
Systematic literature review (Kitchenham and Charters; reported to PRISMA 2020) of 92 primary studies published 2016–2025, screened from 18,343 records in six repositories over four search iterations, with a five-criterion quality assessment and qualitative narrative synthesis across six research questions.Across 92 primary studies (2016–2025), Diffusion Transformers and Gaussian Splatting account for about 36% of studies dated 2024 or later while GAN use has fallen below 3%; training data are demographically skewed and under-documented, and the dominant metrics (PSNR, SSIM, SyncNet) do not measure what deployment requires.
Vajjhala and Strang (2025)
CRC Press (edited book)
Edited volume of 14 chapters; chapter methods include AI/ML system proposals (LSTM–XGBoost fake-news detection, hate-speech detection), comparative technique reviews (malware classification), case studies of breaches and insider threats, and conceptual models (a radial best-practice model for supply chain cyber resilience).The volume connects knowledge management and cybersecurity through AI-based detection (including hybrid LSTM–XGBoost fake-news detection), malware classification, breach and insider-threat cases, supply chain resilience, and the human and organizational factors of social engineering.
Martiri et al. (2025)
CRC Press (edited book)
Edited volume of 10 chapters; chapters combine literature-based trend analyses, thematic and trend analysis of workforce upskilling, sector cases (digital marketing, healthcare, Kazakh businesses), and framework development.The volume maps current trends in AI-enabled threat intelligence and assembles sector and regional evidence — digital marketing fraud, healthcare compliance, workforce upskilling and Kazakh businesses — into guidance for building resilient AI-enabled cybersecurity frameworks.
Strang and Vajjhala (2024b)
2024 4th International Conference on Pervasive Computing and Social Networking (ICPCSN)
Exploratory comparative study applying unsupervised machine learning (t-SNE, radial analysis, correspondence analysis) in Python to hypertext data scraped from about 848 U.S. higher education website records.Unsupervised machine learning (t-SNE with radial and correspondence analysis) applied to hypertext from US higher-education websites (a sample of 848), containing over 4,000 potential indicators, scored breach likelihood on a 1–3 scale and flagged concentrations of higher-risk components; a combined control feature was the most useful risk signal.
Strang and Vajjhala (2023b)
Cybersecurity for Decision Makers
Narrative review and descriptive case analysis of 25 major publicly reported cyberattacks (2020–2022), classified by attack type, source and motive, with a review of Industry 4.0 security issues.An analysis of 25 major cyberattacks (2020–2022) classified 44% as extortion, 32% as service disruption and 24% as data theft, with 36% involving bitcoin ransom.
Vajjhala and Strang (2023)
CRC Press (edited book)
Edited volume of 23 chapters by 46 contributors from 11 countries; chapter methods include case-study analysis, systematic literature review, empirical surveys of psychological factors, comparative regional analysis, and conceptual and policy frameworks.Contributors from 11 countries integrate theory with evidence-based practice on cyberattack causes, human factors, awareness, cybercrime trends, emerging domains such as space and cyber-physical systems, and business continuity, giving decision-makers actionable mitigation strategies.
Olaniyan et al. (2023)
Computational Intelligence for Engineering and Management Applications: Select Proceedings of CIEMA 2022
Conceptual and applied overview (short conference paper) of AI-based user and entity behavioural analytics for cyber threat detection and vulnerability management; no empirical dataset is reported in the abstract.The paper positions user and entity behavioural analytics (UEBA) as an AI approach that scans large volumes of system and network data to discover where attacks originate and to recommend responses to organizational decision-makers.
Strang et al. (2020a)
Innovations in Cybersecurity Education
Conceptual chapter combining a literature search (ProQuest Central and EBSCO) with the authors’ teaching experience and cybersecurity curriculum frameworks (ACM CSEC, ABET, CAE) to develop a two-dimensional teaching typology.A literature search found only five relevant peer-reviewed papers, which — with the authors’ teaching experience — led to a two-dimensional teaching typology (stakeholder role from programmer to managerial decision-maker; teaching ideology from theoretical to hands-on).
Nasir and Vajjhala (2020)
Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020)
Research design paper for an interpretivist, qualitative, multisite exploratory case study: audio-recorded in-depth personal interviews with 50 managers across 20 medium-sized companies in Nigeria (two per sector across ten key economic sectors).The paper establishes an interpretivist, multisite case-study design — in-depth interviews with 50 managers in 20 medium-sized Nigerian companies across ten economic sectors — for identifying the non-technical drivers of information security compliance in SMEs.

Key terms in this area

Industry 4.0
The fourth industrial revolution: the digitalization of industry through technologies such as the Internet of Things, cyber-physical systems, big data analytics, cloud computing, artificial intelligence and autonomous machines. — as used in Strang and Vajjhala (2023b)
Cyber extortion (ransomware)
A cyberattack that demands money or assets, often by encrypting critical systems with ransomware or threatening to publish stolen data until a ransom, typically in bitcoin, is paid. — as used in Strang and Vajjhala (2023b)
Parkerian hexad
Six elements of information security — confidentiality, control, integrity, authenticity, availability and utility — that cybersecurity investment aims to protect. — as used in Strang and Vajjhala (2023b)
t-SNE (t-distributed stochastic neighbor embedding)
A machine learning technique that reduces high-dimensional data to a lower-dimensional map by minimizing the Kullback-Leibler divergence between pairwise similarity distributions, keeping similar points close and dissimilar points apart. — as used in Strang and Vajjhala (2024b)
Unsupervised machine learning
Machine learning that finds structure or patterns in data without a labeled outcome variable. — as used in Strang and Vajjhala (2024b)
Data triangulation
Checking the reliability and validity of findings by comparing results across multiple methods or data sources. — as used in Strang and Vajjhala (2024b)
Talking face generation (TFG)
The synthesis of photorealistic, temporally coherent video in which a face speaks in synchrony with a given audio signal, typically from a single portrait image and an audio clip. — as used in Salahudeen et al. (2026)
Diffusion Transformer (DiT)
A diffusion model in which the usual U-Net denoising network is replaced by a transformer operating over latent tokens, so that output quality scales with model size and compute. — as used in Salahudeen et al. (2026)
Gaussian Splatting
A 3D rendering approach that represents a head or scene as learned 3D Gaussians and draws them by fast differentiable rasterisation instead of volume rendering, which makes real-time talking-head synthesis possible. — as used in Salahudeen et al. (2026)
Content provenance (C2PA)
A cryptographically signed manifest, specified by the Coalition for Content Provenance and Authenticity (C2PA v2.0), recording how a media asset was produced and bound to that asset, so that the authenticity and integrity of the claim can be verified. — as used in Salahudeen et al. (2026)
Deepfake Detectability Rate (DDR)
A metric proposed in this review: the proportion of generated frames correctly classified as synthetic by an ensemble of state-of-the-art deepfake detectors, intended to operationalise the machine-detectability required by EU AI Act Article 50(2). — as used in Salahudeen et al. (2026)
Systemic embeddedness
The sixth principle the RTFG-STS Framework adds to the five AI4People principles: the design and governance of a generative system should reference the concrete socio-technical context in which it is deployed, not the model in isolation. — as used in Salahudeen et al. (2026)

All key terms across the publications →

Standards, datasets and methods named in these studies

References

How to cite this synthesis

Please cite the original publications above for specific findings. To cite this overview itself:

Vajjhala, N. R. (2026, October 4). Cybersecurity as a decision-making, organizational and educational problem. Narasimha Rao Vajjhala. https://www.narasimharao.net/research/focus-areas/cybersecurity/

Markdown version