Research synthesis · Cybersecurity

Cybersecurity as a decision-making, organizational and educational problem

Vajjhala and colleagues treat cyber risk as a problem of decision-making, organizational behaviour and education as much as technology: most major attacks exploit missed warnings, unpatched systems and insecure contractors, awareness and compliance depend on social, cultural and organizational factors, and the research literature on talking face generation has so far built in almost no safeguards against deepfake misuse. The same analytical methods run through a civil-security strand — face recognition for the identification of missing persons, and correspondence analysis of open global terrorism data.

A short narrative review of research by Narasimha Rao Vajjhala and co-authors in this area. Every claim carries an APA citation that links to the publication’s own page (abstract, key findings, DOI); the full references are listed at the end. Updated .

Synthesis

Narasimha Rao Vajjhala’s cybersecurity research treats cyber risk as a problem of decision-making, organizational behaviour and education as much as of technology. In an analysis of 25 major cyberattacks between 2020 and 2022, Strang and Vajjhala (2023b) found that extortion was the most common motive (44%), followed by service disruption (32%) and data theft (24%), and that 36% of attacks involved bitcoin ransom. They traced many incidents to missed warnings, unpatched or unmonitored systems, insecure contractors and insecure software updates, and recommended regular log audits, prompt patching, scanning of software updates, awareness training, contractual cybersecurity clauses and intrusion detection systems.

The group has also shown how machine learning can make cyber risk measurable. Strang and Vajjhala (2024b) applied t-SNE, radial analysis and correspondence analysis to hypertext extracted from about 848 US higher-education website records, containing over 4,000 potential security indicators, and scored each institution’s breach likelihood on a 1–3 scale; a combined control feature was the most useful signal for flagging very high-risk components. Olaniyan et al. (2023) positioned user and entity behavioural analytics as an AI approach for discovering where attacks originate and recommending responses to organizational decision-makers.

Two studies take the same analytical methods into civil security, where the subject is not an organization’s network but a population at risk. Imoh et al. (2023) built an experimental face recognition system — a convolutional neural network with high-standard facial calibration and modelling for feature extraction, matching the resulting face encodings against a query image — for the identification of missing persons, motivated by International Committee of the Red Cross figures of more than 40,000 people reported missing in Africa in 2020, over 23,000 of them in Nigeria and most attributed to insurgency and insecurity. They argued that word of mouth, media announcements and social media are too slow where time is critical, and that automated face matching could shorten search and identification for law enforcement agencies, human rights organisations and families. Earlier, Vajjhala et al. (2015) showed that qualitative open big data on violent incidents can be analysed with desktop statistical software: simple correspondence analysis in SPSS 21 on an open meta big dataset of 125,087 global terrorism records — 133 fields and 16,636,571 data points covering 1970–2013 — related nine attack methods to 13 world regions, with the first two dimensions capturing 94.5% of total inertia, while the overall association between attack type and region proved low (0.21). Both papers bear on the evidence base for security research: one on biometric identification and its oversight, the other on what open incident data can and cannot support by way of strategic inference.

A distinctive strand of the work concerns the human and cultural context of security. Nasir and Vajjhala (2020) argued that low information security awareness and compliance in sub-Saharan Africa are only partly explained by Internet penetration, infrastructure, literacy and technology costs, and that behavioural, social, cultural and organizational factors are neglected by a literature centred on developed countries; they set out an interpretivist multisite design covering 50 managers in 20 Nigerian firms. On the education side, Strang et al. (2020a) found only five peer-reviewed papers on teaching blockchain and proposed a two-dimensional typology — from programmer to managerial decision-maker, and from theoretical to hands-on teaching — concluding that blockchain is an essential part of modern cybersecurity education.

Generative AI extends this agenda to synthetic media. Reviewing 92 talking face generation studies published between 2016 and 2025, Salahudeen et al. (2026) found that only one system embedded any technical safeguard — a post hoc watermark that was not C2PA-compliant — and that none implemented consent or provenance, although EU AI Act Article 50 transparency obligations for synthetic content have applied since 2 August 2026. They proposed the RTFG-STS Framework, which combines cryptographically signed C2PA provenance with risk-tiered consent, a deepfake detectability audit and human oversight, as a research construct for deploying the technology responsibly in identity management and other socio-technical systems.

Vajjhala has extended this agenda through edited volumes aimed at practitioners and policymakers: evidence-based strategies for managers and policymakers (Vajjhala & Strang, 2023), the protection of organizational knowledge assets through AI-based detection, malware classification and insider-threat cases (Vajjhala & Strang, 2025), and AI-enabled threat intelligence and cyber risk assessment (Martiri et al., 2025).

The common conclusion is that organizations reduce cyber risk most reliably by combining technical controls with informed decision-makers, security-aware cultures and curricula that prepare both technical and managerial graduates.

Key claims with sources

  1. Of 25 major cyberattacks in 2020–2022, 44% were extortion, 32% service disruption and 24% data theft; 36% involved bitcoin ransom (Strang & Vajjhala, 2023b).
  2. Unsupervised machine learning on hypertext from about 848 US higher-education website records can score breach likelihood (Strang & Vajjhala, 2024b).
  3. Low information security awareness in sub-Saharan African SMEs is only partly explained by infrastructure, literacy and cost (Nasir & Vajjhala, 2020).
  4. Of 92 talking face generation studies published in 2016–2025, only one embedded any technical safeguard, and none implemented consent or provenance (Salahudeen et al., 2026).
  5. A convolutional-neural-network face recognition system was built to help law enforcement agencies, human rights organisations and families identify missing persons, against ICRC figures of more than 40,000 people reported missing in Africa in 2020 (Imoh et al., 2023).
  6. Correspondence analysis of 125,087 open global terrorism records related nine attack methods to 13 world regions, with the first two dimensions capturing 94.5% of total inertia (Vajjhala et al., 2015).

The publications and what each contributes

PublicationMethodCore finding or contribution
Salahudeen et al. (2026)
Systems
Systematic literature review (Kitchenham and Charters; reported to PRISMA 2020) of 92 primary studies published 2016–2025, screened from 18,343 records in six repositories over four search iterations, with a five-criterion quality assessment and qualitative narrative synthesis across six research questions.Across 92 primary studies (2016–2025), Diffusion Transformers and Gaussian Splatting account for about 36% of studies dated 2024 or later while GAN use has fallen below 3%; training data are demographically skewed and under-documented, and the dominant metrics (PSNR, SSIM, SyncNet) do not measure what deployment requires.
Vajjhala and Strang (2025)
CRC Press (edited book)
Edited volume of 14 chapters; chapter methods include AI/ML system proposals (LSTM–XGBoost fake-news detection, hate-speech detection), comparative technique reviews (malware classification), case studies of breaches and insider threats, and conceptual models (a radial best-practice model for supply chain cyber resilience).The volume connects knowledge management and cybersecurity through AI-based detection (including hybrid LSTM–XGBoost fake-news detection), malware classification, breach and insider-threat cases, supply chain resilience, and the human and organizational factors of social engineering.
Martiri et al. (2025)
CRC Press (edited book)
Edited volume of 10 chapters; chapters combine literature-based trend analyses, thematic and trend analysis of workforce upskilling, sector cases (digital marketing, healthcare, Kazakh businesses), and framework development.The volume maps current trends in AI-enabled threat intelligence and assembles sector and regional evidence — digital marketing fraud, healthcare compliance, workforce upskilling and Kazakh businesses — into guidance for building resilient AI-enabled cybersecurity frameworks.
Strang and Vajjhala (2024b)
2024 4th International Conference on Pervasive Computing and Social Networking (ICPCSN)
Exploratory comparative study applying unsupervised machine learning (t-SNE, radial analysis, correspondence analysis) in Python to hypertext data scraped from about 848 U.S. higher education website records.Unsupervised machine learning (t-SNE with radial and correspondence analysis) applied to hypertext from US higher-education websites (a sample of 848), containing over 4,000 potential indicators, scored breach likelihood on a 1–3 scale and flagged concentrations of higher-risk components; a combined control feature was the most useful risk signal.
Strang and Vajjhala (2023b)
Cybersecurity for Decision Makers
Narrative review and descriptive case analysis of 25 major publicly reported cyberattacks (2020–2022), classified by attack type, source and motive, with a review of Industry 4.0 security issues.An analysis of 25 major cyberattacks (2020–2022) classified 44% as extortion, 32% as service disruption and 24% as data theft, with 36% involving bitcoin ransom.
Vajjhala and Strang (2023)
CRC Press (edited book)
Edited volume of 23 chapters by 46 contributors from 11 countries; chapter methods include case-study analysis, systematic literature review, empirical surveys of psychological factors, comparative regional analysis, and conceptual and policy frameworks.Contributors from 11 countries integrate theory with evidence-based practice on cyberattack causes, human factors, awareness, cybercrime trends, emerging domains such as space and cyber-physical systems, and business continuity, giving decision-makers actionable mitigation strategies.
Olaniyan et al. (2023)
Computational Intelligence for Engineering and Management Applications: Select Proceedings of CIEMA 2022
Conceptual and applied overview (short conference paper) of AI-based user and entity behavioural analytics for cyber threat detection and vulnerability management; no empirical dataset is reported in the abstract.The paper positions user and entity behavioural analytics (UEBA) as an AI approach that scans large volumes of system and network data to discover where attacks originate and to recommend responses to organizational decision-makers.
Imoh et al. (2023)
Proceedings of International Conference on Frontiers in Computing and Systems: COMSYS 2021
Experimental system design: face recognition with a convolutional neural network, facial calibration and modelling for feature extraction, and comparison of face encodings against a query image.The authors built an experimental face-recognition system that combines a convolutional neural network with facial calibration and modelling to extract face encodings and match them against a query image, as a faster tool for identifying missing persons.
Strang et al. (2020a)
Innovations in Cybersecurity Education
Conceptual chapter combining a literature search (ProQuest Central and EBSCO) with the authors’ teaching experience and cybersecurity curriculum frameworks (ACM CSEC, ABET, CAE) to develop a two-dimensional teaching typology.A literature search found only five relevant peer-reviewed papers, which — with the authors’ teaching experience — led to a two-dimensional teaching typology (stakeholder role from programmer to managerial decision-maker; teaching ideology from theoretical to hands-on).
Nasir and Vajjhala (2020)
Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020)
Research design paper for an interpretivist, qualitative, multisite exploratory case study: audio-recorded in-depth personal interviews with 50 managers across 20 medium-sized companies in Nigeria (two per sector across ten key economic sectors).The paper establishes an interpretivist, multisite case-study design — in-depth interviews with 50 managers in 20 medium-sized Nigerian companies across ten economic sectors — for identifying the non-technical drivers of information security compliance in SMEs.
Vajjhala et al. (2015)
2015 3rd International Conference on Future Internet of Things and Cloud (FiCloud), Rome, Italy
Positivist exploratory case study applying simple correspondence analysis in SPSS 21 to an open big dataset of 125,087 global terrorism records (1970–2013), relating nine attack methods to 13 world regions.Simple correspondence analysis in standard statistical software, applied to 125,087 global terrorism records (1970–2013), related nine attack methods to 13 world regions with two dimensions capturing 94.5% of inertia — demonstrating an accessible method for visualizing open big data.

Key terms in this area

Industry 4.0
The fourth industrial revolution: the digitalization of industry through technologies such as the Internet of Things, cyber-physical systems, big data analytics, cloud computing, artificial intelligence and autonomous machines. — as used in Strang and Vajjhala (2023b)
Cyber extortion (ransomware)
A cyberattack that demands money or assets, often by encrypting critical systems with ransomware or threatening to publish stolen data until a ransom, typically in bitcoin, is paid. — as used in Strang and Vajjhala (2023b)
Parkerian hexad
Six elements of information security — confidentiality, control, integrity, authenticity, availability and utility — that cybersecurity investment aims to protect. — as used in Strang and Vajjhala (2023b)
t-SNE (t-distributed stochastic neighbor embedding)
A machine learning technique that reduces high-dimensional data to a lower-dimensional map by minimizing the Kullback-Leibler divergence between pairwise similarity distributions, keeping similar points close and dissimilar points apart. — as used in Strang and Vajjhala (2024b)
Unsupervised machine learning
Machine learning that finds structure or patterns in data without a labeled outcome variable. — as used in Strang and Vajjhala (2024b)
Data triangulation
Checking the reliability and validity of findings by comparing results across multiple methods or data sources. — as used in Strang and Vajjhala (2024b)
Talking face generation (TFG)
The synthesis of photorealistic, temporally coherent video in which a face speaks in synchrony with a given audio signal, typically from a single portrait image and an audio clip. — as used in Salahudeen et al. (2026)
Diffusion Transformer (DiT)
A diffusion model in which the usual U-Net denoising network is replaced by a transformer operating over latent tokens, so that output quality scales with model size and compute. — as used in Salahudeen et al. (2026)
Gaussian Splatting
A 3D rendering approach that represents a head or scene as learned 3D Gaussians and draws them by fast differentiable rasterisation instead of volume rendering, which makes real-time talking-head synthesis possible. — as used in Salahudeen et al. (2026)
Content provenance (C2PA)
A cryptographically signed manifest, specified by the Coalition for Content Provenance and Authenticity (C2PA v2.0), recording how a media asset was produced and bound to that asset, so that the authenticity and integrity of the claim can be verified. — as used in Salahudeen et al. (2026)
Deepfake Detectability Rate (DDR)
A metric proposed in this review: the proportion of generated frames correctly classified as synthetic by an ensemble of state-of-the-art deepfake detectors, intended to operationalise the machine-detectability required by EU AI Act Article 50(2). — as used in Salahudeen et al. (2026)
Systemic embeddedness
The sixth principle the RTFG-STS Framework adds to the five AI4People principles: the design and governance of a generative system should reference the concrete socio-technical context in which it is deployed, not the model in isolation. — as used in Salahudeen et al. (2026)
Face encodings
Features extracted through facial calibration and modelling, which the experimental system compares with a given image to identify a match. — as used in Imoh et al. (2023)
Correspondence analysis
A multivariate exploratory technique that estimates the interdependence (inertia) between categorical variables in a contingency table and plots them as distances in a low-dimensional map. — as used in Vajjhala et al. (2015)
Open big data
Very large datasets made publicly available, here a meta dataset summarizing terrorist activity as keyword frequencies from public news articles. — as used in Vajjhala et al. (2015)
Inertia
In correspondence analysis, the measure of association between row and column factors, whose proportion accounted for by each dimension indicates how much of the relationship a plot captures. — as used in Vajjhala et al. (2015)

All key terms across the publications →

Standards, datasets and methods named in these studies

References

  • Imoh, N., Vajjhala, N. R., & Rakshit, S. (2023). Experimental Face Recognition Using Applied Deep Learning Approaches to Find Missing Persons. In S. Basu, D. K. Kole, A. K. Maji, D. Plewczynski, & D. Bhattacharjee (Eds.), Proceedings of International Conference on Frontiers in Computing and Systems: COMSYS 2021 (pp. 3–11). Springer Nature Singapore. https://doi.org/10.1007/978-981-19-0105-8_1 Summary & key findings →
  • Martiri, E., Vajjhala, N. R., & Dalipi, F. (Eds.). (2025). AI-Enabled Threat Intelligence and Cyber Risk Assessment. CRC Press. https://doi.org/10.1201/9781003504979 Summary & key findings →
  • Nasir, S., & Vajjhala, N. R. (2020). Evaluating Information Security Awareness and Compliance in Sub-Saharan Africa: An Interpretivist Perspective. In M. B. Nunes, P. Isaías, P. Powell, & B. Bontchev (Eds.), Proceedings of the 13th IADIS International Conference Information Systems 2020 (IS 2020) (pp. 187–190). IADIS Press. https://www.iadisportal.org/digital-library/evaluating-information-security-awareness-and-compliance-in-sub-saharan-africa-an-interpretivist-perspective Summary & key findings →
  • Olaniyan, R., Rakshit, S., & Vajjhala, N. R. (2023). Application of User and Entity Behavioral Analytics (UEBA) in the Detection of Cyber Threats and Vulnerabilities Management. In P. Chatterjee, D. Pamucar, M. Yazdani, & D. Panchal (Eds.), Computational Intelligence for Engineering and Management Applications: Select Proceedings of CIEMA 2022 (pp. 419–426). Springer Nature Singapore. https://doi.org/10.1007/978-981-19-8493-8_32 Summary & key findings →
  • Salahudeen, R., Fonkam, M., Vajjhala, N. R., Junaidu, S. B., & Garba, A. (2026). Talking Face Generation in Socio-Technical Systems: A Systematic Review of Deep Learning Architectures, Deployment Contexts, and Governance Frameworks. Systems, 14(10), Article 1198. https://doi.org/10.3390/systems14101198 Summary & key findings →
  • Strang, K. D., & Vajjhala, N. R. (2023b). Why Cyberattacks Disrupt Society and How to Mitigate Risk. In N. R. Vajjhala & K. D. Strang (Eds.), Cybersecurity for Decision Makers (pp. 1–28). CRC Press / Taylor & Francis. https://doi.org/10.1201/9781003319887-1 Summary & key findings →
  • Strang, K. D., & Vajjhala, N. R. (2024b). Exploring Cybersecurity Risks in Higher Education Environments with Machine Learning. In 2024 4th International Conference on Pervasive Computing and Social Networking (ICPCSN) (pp. 1–6). IEEE. https://doi.org/10.1109/ICPCSN62568.2024.00008 Summary & key findings →
  • Strang, K. D., Che, F., & Vajjhala, N. R. (2020a). Ideologies and Issues for Teaching Blockchain Cybersecurity in Management and Computer Science. In K. Daimi & G. Francia III (Eds.), Innovations in Cybersecurity Education (pp. 109–126). Springer. https://doi.org/10.1007/978-3-030-50244-7_7 Summary & key findings →
  • Vajjhala, N. R., & Strang, K. D. (Eds.). (2023). Cybersecurity for Decision Makers. CRC Press. https://doi.org/10.1201/9781003319887 Summary & key findings →
  • Vajjhala, N. R., & Strang, K. D. (Eds.). (2025). Cybersecurity in Knowledge Management: Cyberthreats and Solutions. CRC Press. https://doi.org/10.1201/9781003498094 Summary & key findings →
  • Vajjhala, N. R., Strang, K. D., & Sun, Z. (2015). Statistical Modeling and Visualizing Open Big Data Using a Terrorism Case Study. In 2015 3rd International Conference on Future Internet of Things and Cloud (FiCloud), Rome, Italy (pp. 489–496). IEEE. https://doi.org/10.1109/FiCloud.2015.15 Summary & key findings →

How to cite this synthesis

Please cite the original publications above for specific findings. To cite this overview itself:

Vajjhala, N. R. (2026, October 21). Cybersecurity as a decision-making, organizational and educational problem. Narasimha Rao Vajjhala. https://www.narasimharao.net/research/focus-areas/cybersecurity/

Markdown version