Cybersecurity Analytics and Cyber Threat Intelligence in Business Information Systems: A Systematic Literature Review Protocol and Proposed Conceptual Framework

Abstract

Security teams usually describe cybersecurity analytics and cyber threat intelligence (CTI) in practical terms: they are what lets an organization turn uneven, scattered data into a decision that has to be made before the window closes. The managerial side of that account is spread thin across three literatures — technical security research, information systems scholarship, and organizational studies — which, for whatever reason, rarely cite one another. This paper sets out a protocol for a systematic literature review (SLR) on cybersecurity analytics, CTI, decision processes, governance, and organizational cyber resilience in business information systems, along with some preliminary background. The window runs from 1 January 2015 to 31 December 2025. It should be read as a plan, not a finding. No searches have been completed, so there are no screening numbers, no PRISMA counts, no results from included studies, and — this matters most — no validated causal model. When the review is run, it will draw on Scopus, Web of Science Core Collection, IEEE Xplore, and ACM Digital Library, topped up with a few publisher platforms and with citation chasing in both directions to catch what the databases miss. Two reviewers will screen and extract independently, then compare, so that disagreements get logged and argued out rather than quietly averaged. During synthesis, technical analytics outcomes stay apart from organizational and managerial ones; quality is judged against criteria fitted to each study design rather than one blanket scale; and the work leans on narrative and thematic synthesis, with meta-analysis deliberately left out at this stage. A preliminary conceptual framework comes with the protocol, offered only as a proposition: data governance may support intelligence quality, which may support decision quality, which may in turn feed organizational cyber resilience — with context and feedback loops acknowledged rather than assumed away. None of those links has been tested. The sharp line drawn between protocol and results is intentional — it gives a later, auditable review something stable to stand on, and gives the empirical management research that follows a defined place to start.