Research report: An integrative theoretical model of AI-supported cybersecurity governance and organizational resilience

Using a theory-synthesis design and an integrative literature review, the paper connects bodies of scholarship that have largely evolved in parallel: organizational resilience, cybersecurity governance, AI governance, human-AI decision-making, adversarial machine learning, risk governance, organizational learning, and dynamic capabilities. At the heart of the paper is a new construct: AI-supported cybersecurity governance. The author defines it as a formal organizational arrangement through which heterogeneous AI-generated evidence, including predictive scores, anomaly signals, generative summaries, and semi-autonomous recommendations, is institutionally translated into cybersecurity direction, oversight, prioritization, coordination, reporting, accountability, and learning.

The definition matters because it separates genuine governance-level integration from mere AI use. An organization may deploy cutting-edge detection models without ever embedding their outputs in committees, decision rights, or accountability structures; under this framework, that deployment does not constitute governance at all. The model identifies a distinctive positive pathway that AI offers beyond periodic rule-based business intelligence or exclusively human analysis.

Depending on their architecture, data, and deployment, AI systems can process streaming and heterogeneous data at scale, fuse information across disparate sources, detect nonlinear and cross-system patterns, produce probabilistic forecasts, update estimates rapidly, and synthesize complex evidence for different audiences. Crucially, however, the paper insists that these affordances do not create resilience automatically. Instead, the conversion happens through five governance mechanisms.

Enhanced visibility arises when AI continuously fuses high-volume evidence from logs, identities, endpoints, vulnerabilities, third parties, and business dependencies, surfacing weak or cross-system patterns earlier than siloed analysis. Improved prioritization emerges through probabilistic forecasting and dynamic risk scoring that integrate technical severity, asset criticality, exploitability, and potential propagation, rather than relying on static rankings. Stronger coordination comes from translating the same underlying signals into role-specific views, so technical teams see operational detail, legal functions see exposure and obligations, and executives see business consequences.

More informed oversight extends board supervision beyond retrospective reporting by continuously comparing observed conditions with risk thresholds and preserving structured records of recommendations, confidence levels, and overrides. Finally, structured organizational learning occurs when AI mines longitudinal incident data to detect recurring vulnerabilities, but only if those insights are codified into revised policies, routines, and accountability arrangements. The explanatory backbone of the model is the theory of dynamic capabilities, which describes how organizations sense, seize, and reconfigure under uncertainty.

In this framework, enhanced visibility supports sensing by expanding the scale and continuity of governance-level awareness. Improved prioritization, coordination, and oversight support seizing, enabling decision-makers to compare scenarios, allocate resources, and authorize responses as evidence changes. Structured learning supports reconfiguring, converting accumulated experience into revised escalation criteria and decision rights.

Organizational resilience itself is represented through three phases: anticipation before disruption, coping during disruption, and adaptation afterward. The paper is equally explicit about how the same pathway can be weakened or reversed. Continuous and persuasive AI outputs can intensify automation bias, leading governance actors to over-trust recommendations or ignore contradictory evidence.

Model opacity can make it difficult to justify decisions or detect when a model has drifted. Dynamic prioritization can become false prioritization when data are incomplete or rare strategic risks are underrepresented. Accountability gaps arise when responsibility is diffused among technical teams, vendors, committees, and AI systems themselves.

Perhaps most striking is a distinctly cybersecurity-specific failure mode: the AI layer itself becomes an attack surface. Data poisoning can corrupt training processes, evasion attacks can cause deployed models to misclassify crafted inputs, and alert flooding can exhaust prioritization capacity. Once AI-supported evidence is embedded in governance, successful manipulation can alter the threat picture presented to executives and boards, not merely bypass an operational control.

Vendor dependence adds another layer of fragility. Many organizations rely on AI capabilities embedded in third-party security platforms rather than models they develop or fully audit themselves, meaning they may lack access to training data, model parameters, validation evidence, or change histories. The model argues that accountability must therefore extend into procurement and contract design, encompassing audit rights, model-change notification, incident disclosure, and exit arrangements.

Vendor opacity, lock-in, and limited auditability are treated as boundary conditions that can weaken translation, oversight, and accountability. The framework also specifies when AI-supported governance should deliver the greatest incremental value. Three external scope conditions are identified: high threat velocity, high data volume and heterogeneity, and strong digital interdependence.

Internally, outcomes depend on what the paper calls organizational assurance and conversion capacity, reflected in cybersecurity capability, governance maturity, data quality, regulatory accountability, calibrated human-AI trust, and vendor auditability. The author formalizes these ideas in a series of testable propositions and operationalizable hypotheses, including the claim that formal institutional embedding of AI-supported evidence is positively associated with resilience, that the five mechanisms mediate that relationship, and that the association may turn negative where automation bias, opacity, or adversarial manipulation dominate. That means classifying systems by model type, autonomy, and provenance; assigning model-specific validation and override requirements; communicating uncertainty rather than point estimates; preserving traceable decision records; testing the AI layer under adversarial conditions; and extending accountability into vendor contracts.

As a conceptual contribution, the study does not provide direct empirical evidence, but it offers researchers a falsifiable agenda: comparative studies of AI-supported versus conventional governance arrangements, stratified by model class and sourcing, could finally establish whether, when, and why machine intelligence strengthens the human institutions it is meant to protect.

Subject of Research: A theoretical model of how AI-supported cybersecurity governance translates machine-generated evidence into organizational resilience

Article Title: An integrative theoretical model of AI-supported cybersecurity governance and organizational resilience

Article References: Tersek, I. (2026). An integrative theoretical model of AI-supported cybersecurity governance and organizational resilience. Discover Artificial Intelligence, 6(1), Article 1268. https://doi.org/10.1007/s44163-026-02363-0

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02363-0

Keywords: artificial intelligence, cybersecurity governance, organizational resilience, dynamic capabilities, AI governance, adversarial machine learning, automation bias, human-AI decision-making, risk governance, organizational learning, vendor accountability, theory synthesis