1.1. Research Questions

To address the identified gap between advanced AI-driven cybersecurity technologies and national governance requirements, this study investigates the following research questions:

RQ1: How can AI-driven threat intelligence improve national cybersecurity governance and strategic decision-making?

RQ2: How can governance requirements, including transparency, accountability, legal compliance, and institutional oversight, be embedded within AI-based threat intelligence architectures?

RQ3: How can policy-aware response mechanisms improve national cyber resilience against sophisticated and rapidly evolving cyber threats?

RQ4: What architectural components and governance mechanisms are required to ensure effective integration between AI-driven analytics and national cybersecurity governance frameworks?

The contributions of this paper are fourfold:

The remainder of this paper is structured as follows. Section 2 reviews related work in cybersecurity governance, threat intelligence, and AI-driven security systems. Section 3 examines the limitations of traditional governance models and the evolving role of threat intelligence. Section 4 presents the detailed architecture and design of the proposed framework. Section 5 describes machine learning components and methodologies. Section 6 discusses policy-aware response mechanisms and governance alignment. Section 7 presents implementation considerations and case studies. Section 8 provides a comprehensive discussion of implications and challenges. Section 9 concludes with future research directions.

2.1. Threat Intelligence Systems and Frameworks

Threat intelligence has evolved from manual collection and analysis processes to increasingly automated and data-driven approaches. Traditional threat intelligence platforms, such as security information and event management (SIEM) systems, aggregate logs and alerts from multiple sources but often require extensive manual configuration and tuning. The MITRE ATT&CK framework has become a standard taxonomy for describing adversary tactics and techniques, enabling more structured threat analysis and intelligence-sharing. Standards such as STIX/TAXII facilitate structured threat intelligence exchange across organisations. However, such frameworks primarily support manual analysis and lack the adaptive capabilities needed for rapidly evolving threats.

Intelligence-driven security operations centres (ISOCs) represent an organisational approach to integrating threat intelligence into security operations. These centres coordinate between technical security teams and strategic decision makers, but they often face challenges in scaling threat analysis and maintaining situational awareness across complex, distributed infrastructures. The disconnect between technical threat indicators and strategic intelligence requirements remains a persistent challenge.

2.2. AI-Driven Security Analytics

Machine learning has been extensively applied to cybersecurity problems, including intrusion detection, malware classification, and anomaly detection. Unsupervised learning techniques, such as clustering and autoencoders, have shown promise in detecting previously unknown threats and zero-day attacks. Supervised learning approaches, trained on labelled datasets of known attacks, achieve high accuracy but struggle with novel attack patterns. Ensemble methods and deep-learning architectures have improved detection rates for complex, multistage attacks.

Graph-based analytics have emerged as a powerful approach for threat correlation and attack campaign detection. By modelling systems, users, and network flows as graphs, these methods can identify patterns of coordinated activity that might be invisible when examining individual events in isolation. Graph neural networks (GNNs) extend this capability by learning complex relationships and temporal patterns from network data.

Explainable AI (XAI) techniques are increasingly important for security applications, particularly in governance contexts where decision transparency is required. Methods such as Local Interpretable Model Agnostic Explanations (LIME) and SHapley Additive exPlanations (SHAP) provide post hoc explanations for model predictions, while inherently interpretable models like decision trees offer built-in transparency. However, balancing explainability with model performance remains a challenge, particularly for complex deep-learning architectures.

2.3. Governance Frameworks and Policy Alignment

Cybersecurity governance research has explored various institutional arrangements, policy frameworks, and regulatory approaches. The National Institute of Standards and Technology’s (NIST) cybersecurity framework (CSF) provides a structured approach to managing cybersecurity risks but focuses primarily on organisational rather than national-level governance. European frameworks, such as the NIS directive and its successor, NIS2, establish requirements for critical infrastructure protection but do not specify technical implementation approaches.

Research on AI governance emphasises the importance of transparency, accountability, fairness, and human oversight. The European Union’s (EU) AI Act establishes a risk-based regulatory framework for AI systems, categorising them by risk-level and imposing corresponding requirements. European frameworks, such as the NIS Directive and its successor, NIS2, establish requirements for critical infrastructure protection. High-risk AI systems, including those used for critical infrastructure, must meet stringent requirements for transparency, human oversight, and robustness. However, the translation of these governance principles into specific technical architectures remains an open research question.

The integration of AI systems with legal and policy frameworks presents unique challenges. Automated decision-making systems must respect legal principles, such as due process, proportionality, and the right to explanation. In the cybersecurity context, automated threat responses must balance effectiveness with legal constraints, including privacy protection, data sovereignty, and jurisdictional boundaries. Research on ‘policy-aware’ systems has explored formal methods for encoding legal rules and policy constraints into automated decision-making processes, but application to cybersecurity governance remains limited.

2.4. Integration Challenges and Hybrid Approaches

Research examining the integration of AI systems with governance frameworks has identified several recurring challenges that complicate the deployment of AI-driven solutions in governance contexts:

Some research has explored hybrid approaches that combine automated analysis with human judgement to address these challenges. The concept of ‘human in the loop’ systems preserve human oversight while leveraging AI for data processing and initial analysis. These systems enable AI to handle routine high-volume tasks while reserving complex or high stakes decisions for human judgement. However, these approaches must carefully balance efficiency gains from automation with the value of human judgement, particularly in contexts where decisions have significant consequences for national security or individual rights.

The framework proposed in this paper extends these hybrid approaches by explicitly designing the integration between AI capabilities and governance requirements from the outset, rather than treating governance as a constraint or afterthought. By embedding governance principles into the framework’s architecture, the design process can proactively address integration challenges rather than attempting to resolve them retroactively.

2.5. Research Gaps and Opportunities

Despite significant advances in both AI-driven security analytics and cybersecurity governance research, there remains a critical gap at their intersection. Most AI-based security systems are designed for organisational contexts and do not address the unique requirements of national-level governance, including multi-stakeholder coordination, legal compliance, democratic accountability, and cross-sector information sharing. These systems may excel at technical detection but struggle to translate capabilities into governance-relevant intelligence or coordinate responses across complex institutional structures.

Similarly, governance frameworks provide policy guidance and institutional arrangements but typically lack technical specifications for integrating advanced AI capabilities while preserving governance principles. The translation from policy requirements to technical implementation is often left to practitioners who may lack expertise in both domains, leading to suboptimal solutions or governance principles being compromised for technical expediency.

Academic research has produced numerous innovative AI techniques for cybersecurity problems, but much of this work focuses on isolated technical challenges (detecting specific attack types, classifying malware, and identifying anomalies) without addressing how these capabilities integrate into broader governance contexts. The practical deployment of AI in national cybersecurity governance requires not just effective detection algorithms but also mechanisms for policy alignment, stakeholder coordination, legal compliance, and democratic accountability.

This paper addresses this gap by proposing a comprehensive framework that explicitly bridges technical AI capabilities with governance requirements. The framework is designed to operate within national cybersecurity governance structures, supporting both technical security operations and policy-level decision-making while maintaining transparency, accountability, and legal compliance. By embedding governance principles into the framework’s architecture from the design stage, rather than attempting to add them as constraints or controls afterward, the framework demonstrates how technical capabilities and governance requirements can be mutually reinforcing.

3.1. Limitations of Traditional Governance Models

Traditional cybersecurity governance frameworks emphasise compliance, risk reporting, and incident response protocols. These models typically operate on periodic risk assessments, manual threat analysis, and predefined response playbooks. Human analysts are responsible for interpreting threat data, correlating events across systems, and escalating incidents to appropriate authorities. While this human-centric approach provides valuable judgement and context, it faces fundamental limitations in the face of modern cyber threats.

As cyber environments grow more complex with cloud computing Internet of Things (IoT) devices, mobile networks, and industrial control systems creating vast attack surfaces, manual processes become increasingly inadequate. SOCs process millions of events daily, generating thousands of alerts, yet human analysts can typically review only a small fraction of these. The signal-to-noise ratio is often unfavourable, with critical threats obscured by false positives and routine security events.

Key limitations of traditional governance models include the following:

These weaknesses are particularly dangerous for critical infrastructure sectors, such as energy, telecommunications, healthcare, financial services, and transportation. A successful cyber attack on critical infrastructure can have cascading effects across multiple sectors, disrupting essential services, causing economic damage, and potentially threatening public safety. The 2015 cyber attack on Ukraine’s power grid, for example, demonstrated how targeted attacks on critical infrastructure can cause widespread outages affecting hundreds of thousands of people. Traditional governance models, with their delayed response times and limited coordination capabilities, are ill-equipped to prevent or rapidly respond to such sophisticated, coordinated attacks.

3.2. Role of Threat Intelligence in National Cybersecurity

Threat intelligence aims to collect, analyse, and contextualise information about potential cyber threats, enabling proactive defence and informed decision-making. At the national level, threat intelligence serves multiple functions: providing early warning of emerging threats, supporting attribution of attacks to specific actors or groups, informing strategic policy decisions, and enabling coordinated responses across government agencies and critical infrastructure sectors.

Modern threat intelligence systems aggregate data from diverse sources, including network logs, endpoint telemetry, intrusion detection systems, honeypots, threat feeds from commercial providers, open-source intelligence, and information-sharing partnerships with other nations or organisations [13]. This data diversity, while valuable, also presents challenges. Data formats vary, sources have different levels of reliability and timeliness, and the volume of data can be overwhelming [15].

Traditional threat intelligence processes rely heavily on human analysts to review and correlate information [7]. Analysts examine indicators of compromise (IoCs), review attack patterns, conduct research on threat actors [29], and produce intelligence reports. However, the volume and velocity of threat data often exceed human analytical capacity [16]. Without advanced analytics, threat intelligence systems generate large volumes of alerts with limited actionable insight. Analysts may spend significant time investigating false positives or routine security events while missing subtle indicators of serious threats.

Artificial intelligence has the potential to transform threat intelligence by automating data correlation, identifying hidden patterns across large datasets, and predicting future attack vectors based on historical patterns and the current trends [9]. Machine learning algorithms can process vast volumes of threat data, recognising patterns that human analysts might miss [18]. Natural language processing (NLP) can extract structured intelligence from unstructured sources, such as threat actor communications, vulnerability reports, or incident response documentation. Predictive analytics can identify emerging threat trends before they manifest as active campaigns [17].

However, the integration of AI-driven threat intelligence with governance structures remains an unresolved challenge [11, 23]. Technical threat indicators must be transformed into strategic intelligence that informs policy decisions. AI systems must operate within legal and ethical constraints, respecting privacy, data sovereignty, and jurisdictional boundaries [29]. The explainability of AI-driven threat assessments is crucial for enabling human oversight and accountability [12, 19]. Furthermore, the rapid pace of threat evolution requires continuous model adaptation and validation, processes that must be integrated into governance workflows rather than operating independently.

4.1. Architectural Overview

The framework consists of four interconnected layers, each serving distinct functions while maintaining tight integration to ensure end-to-end governance alignment. The layered architecture enables modular development and maintenance while ensuring that governance principles are embedded throughout the system rather than applied as an afterthought. Figure 1 illustrates the overall architecture and data flow, showing how threat intelligence progresses from raw data sources through processing layers to policy-aware decision support.

Figure 1

Architecture of the proposed AI driven threat intelligence framework for national cybersecurity governance.

4.2. Machine Learning Components

The AI analytics layer employs a sophisticated ensemble of machine learning approaches, each optimised for specific threat detection and analysis tasks. The layer integrates multiple model types to leverage their complementary strengths while mitigating individual limitations.

Figure 2

Operational workflow of the proposed AI driven threat intelligence framework.

4.3. Anomaly Detection and Zero-Day Threat Identification

Unsupervised learning techniques form the foundation for detecting previously unknown threats that lack signature-based indicators. The framework employs several complementary approaches.

Autoencoder-based anomaly detection: Deep autoencoders learn normal behavioural patterns from historical system data, flagging deviations that may indicate novel attack techniques [8]. The models are trained on network traffic patterns, system call sequences, and user behaviour profiles across multiple critical infrastructure sectors.

Isolation forest algorithms: These algorithms efficiently identify outliers in high dimensional feature spaces, detecting rare attack patterns that differ significantly from normal operations [34]. They are particularly effective for detecting stealthy, low-volume attacks that might evade volume-based detection.

One-class support vector machines (SVMs): These models establish boundaries around normal system behaviour, identifying instances that fall outside these boundaries as potential threats. They are well suited for scenarios where attack examples are rare or unavailable.

The framework combines predictions from multiple anomaly detection models using ensemble voting, improving robustness, and reducing false positives. When multiple models independently flag an event as anomalous, confidence in the threat assessment increases significantly.

4.4. Graph-Based Threat Correlation

Graph-based analytics enable the identification of coordinated attack campaigns that span multiple systems, organisations, or periods. The framework constructs multi-layered graphs representing:

Graph neural networks analyse these structures, learning to identify patterns indicative of coordinated campaigns [11]. For example, simultaneous anomalous activities across geographically distributed systems, when connected through shared infrastructure or known threat actor associations, may signal a coordinated attack campaign. The framework employs attention mechanisms to identify the most relevant connections and temporal patterns. Long Short-Term Memory (LSTM) networks [35] complement graph-based analysis by capturing sequential attack behaviours and temporal dependencies. Table 2 summarises the machine learning models used in the framework and their respective roles.

4.5. Explainable AI for Governance

Explainability is essential for maintaining trust and enabling oversight by non-technical decision makers, including policymakers, legal authorities, and senior executives. The framework implements multiple explainability mechanisms:

The framework maintains a confidence score for each prediction, which is calibrated to reflect both model confidence and reliability of underlying data sources. Low-confidence predictions trigger additional human review, ensuring that high-stakes decisions receive appropriate scrutiny.

5.1 Governance Constraints and Legal Compliance

Automated threat detection and response recommendations must respect legal and ethical constraints, including privacy protection, data sovereignty, jurisdictional boundaries, proportionality, and due process [23]. The governance alignment layer encodes these constraints as machine readable rules that guide AI-driven recommendations, following policy-aware system design principles [23].

5.2. Privacy and Data Protection Mechanisms

The framework implements privacy-preserving techniques throughout the data-processing pipeline. Differential privacy mechanisms add calibrated noise to aggregated statistics, preventing inference of individual records while preserving analytical utility. For sensitive personal data, the framework applies techniques such as:

Compliance with regulations, such as the General Data Protection Regulation (GDPR) [36] and national privacy laws, is verified automatically before data processing and threat intelligence-sharing operations.

5.3. Proportionality and Due Process

Automated response recommendations must be proportional to the assessed threat severity and respect due process requirements [32]. The framework categorises threats according to severity levels (low, medium, high, and critical) and maps each level to appropriate response actions [23]. Critical actions, such as network disconnection or system isolation, require additional validation and human approval, even for high confidence automated assessments [24, 32].

The framework maintains audit trails of all automated recommendations and actions, enabling retrospective review and accountability [11]. Decision makers can query these trails to understand why specific recommendations were made, supporting both operational learning and legal compliance [12].

5.4. Jurisdictional and Sovereignty Considerations

National cybersecurity governance must respect jurisdictional boundaries and data sovereignty requirements [37]. The framework implements geo-fencing mechanisms that prevent threat intelligence data from being processed or stored outside authorised jurisdictions [24]. Cross-border data sharing follows established legal frameworks and treaties, with explicit consent mechanisms and data localisation options where required by law [36, 37].

5.5. Institutional Coordination and Stakeholder Management

National cybersecurity governance involves multiple stakeholders, each with distinct roles, responsibilities, and decision-making authorities [33]. The framework supports coordinated decision-making through standardised threat classifications, shared situational awareness, and automated notification and escalation mechanisms [1, 33].

5.6. Threat Classification Framework

The framework employs a standardised threat classification system that maps technical indicators to policy relevant categories. Threats are classified along multiple dimensions:

This multi-dimensional classification enables appropriate routing to relevant agencies and supports coordinated response planning.

5.7. Situational Awareness Dashboard

The framework provides a unified situational awareness dashboard that aggregates threat intelligence across sectors and organisations while respecting information classification and sharing restrictions. The dashboard presents:

Different stakeholders receive customised views appropriate to their roles and clearance levels. Policy-level decision makers see strategic summaries and trend analyses, while technical security teams access detailed technical indicators and response recommendations.

5.8. Automated Escalation and Notification

The framework implements intelligent escalation mechanisms that automatically route threats to appropriate authorities based on severity, sector, and jurisdictional considerations. For example, threats targeting critical energy infrastructure automatically trigger notifications to energy sector regulators, national security agencies, and relevant CERTs, with notifications customised to each recipient’s role and information needs.

Escalation protocols ensure that critical threats receive immediate attention while avoiding alert fatigue from routine security events [7]. Machine learning models predict which threats require escalation based on historical patterns and policy rules, reducing manual filtering overhead [8]. Table 3 outlines key stakeholders and their roles in the framework’s coordination mechanisms.

6.1. Implementation Prerequisites and Requirements

Successful deployment of the framework requires addressing several technical, organisational, and policy prerequisites. These include data infrastructure, organisational readiness, legal frameworks, and capacity-building initiatives.

6.2. Technical Infrastructure Requirements

The framework requires robust technical infrastructure to support data ingestion, processing, storage, and analysis at national scale. Key infrastructure components include:

6.3. Organisational and Governance Prerequisites

Beyond technical infrastructure, successful implementation requires appropriate organisational structures and governance mechanisms:

6.4. Case Study: Critical Infrastructure Protection Scenario

This case study illustrates how the framework might operate in a real-world scenario involving a coordinated attack on critical energy infrastructure. The scenario demonstrates the framework’s ability to detect, analyse, and coordinate response to sophisticated threats.

6.5. Scenario Description

A nation-state adversary initiates a multi phase attack targeting energy sector critical infrastructure [27]. The attack begins with spear-phishing campaigns targeting employees of multiple energy companies, followed by lateral movement through networks, reconnaissance of industrial control systems, and preparation for potential disruption operations [4]. The attack spans multiple organisations and occurs over several weeks, making it difficult to detect through traditional, siloed security monitoring.

6.6. Framework Operation

During the early phases, the framework’s anomaly detection models identify unusual network traffic patterns and authentication anomalies across multiple energy sector organisations [8]. While individually these indicators might be dismissed as benign, graph-based correlation algorithms identify connections indicating a coordinated campaign [11]. The framework correlates indicators, including:

The governance alignment layer classifies the threat as high severity, high confidence, and targeting critical infrastructure with nation-state characteristics [28]. This classification triggers automated escalation to national CERT, energy sector regulator, national security agencies, and affected organisations [33]. Each stakeholder receives customised intelligence reports: technical teams receive detailed indicators and response recommendations, while policy authorities receive strategic summaries emphasising potential impact and required coordination.

The framework’s explainability mechanisms provide clear justifications for threat assessment, enabling decision makers to understand the basis for alerts and make informed response decisions [12, 19]. Policy-aware response recommendations balance immediate containment actions with legal and operational constraints, avoiding disproportionate responses that might disrupt essential services unnecessarily [32].

6.7. Outcomes and Lessons

This scenario demonstrates several key framework capabilities:

The case study also highlights implementation considerations, including the importance of establishing trust and information-sharing agreements before crises occur, the need for clear escalation and response procedures, and the value of XAI in enabling informed decision-making under time pressure.

6.8. Performance Metrics and Evaluation

Evaluating framework effectiveness requires metrics that capture both technical performance and governance objectives.

Technical metrics include:

Governance-focused metrics include:

The framework should be evaluated through controlled testing scenarios, red team exercises [41], and careful monitoring of operational deployments. Continuous improvement requires feedback loops that capture both technical performance data and stakeholder input, enabling iterative refinement of models, policies, and processes [41]. Table 4 presents key performance indicators for framework evaluation.

6.9. Proposed Empirical Validation Strategy

Although the proposed framework is conceptual in nature, its effectiveness can be evaluated through a structured empirical validation process. Future implementation should utilise publicly available cybersecurity datasets, such as CICIDS2017, CICIoT2023, UNSW NB15, and CSE CIC IDS2018.

The validation process would involve training and evaluating multiple machines learning models, including Isolation Forest, Autoencoders, Random Forests, and GNNs. Performance should be assessed using accuracy, precision, recall, F1 score, false positive rate, and detection latency.

In addition to technical evaluation, governance-related metrics should be measured, including policy compliance rate, explainability quality, stakeholder satisfaction, response coordination effectiveness, and transparency indicators.

Red team exercises and cyber range simulations can further assess framework robustness under realistic attack conditions. Such validation would provide quantitative evidence regarding the framework’s ability to support both threat detection and governance-aligned decision-making.

Validation experiments should compare framework performance against traditional SIEM-based monitoring systems and standard threat intelligence workflows. Comparative evaluation should measure detection accuracy, false positive rates, response times, and policy-compliance outcomes under identical operational conditions.

Scenario-based simulations involving ransomware campaigns, APTs, supply chain attacks, and critical infrastructure disruptions can further evaluate framework effectiveness. Such comparative testing would provide evidence regarding the practical advantages and limitations of governance-aware AI-driven threat intelligence architectures.

7.1. Addressing the Governance Technical Gap

The proposed framework addresses a critical gap between technical cybersecurity solutions and governance requirements that has persisted in both research and practice. Traditional security systems excel at technical detection but often operate in isolation from policy and institutional structures. Conversely, governance frameworks provide policy guidance but lack technical specifications for integrating advanced AI capabilities while preserving governance principles, such as transparency, accountability, and legal compliance.

By embedding AI within policy-aware structures from the design stage, the framework demonstrates how technical capabilities and governance requirements can be mutually reinforcing rather than conflicting. The governance alignment layer explicitly translates technical threat indicators into policy-relevant intelligence, ensuring that sophisticated detection capabilities translate into actionable governance insights. This approach contrasts with post hoc attempts to add governance controls to purely technical systems, which often result in compromises or inefficiencies.

The framework’s emphasis on explainability addresses a fundamental governance requirement: the ability of human decision makers to understand, validate, and if necessary, override automated recommendations. This is particularly important in national security contexts where decisions may have significant legal, political, or operational consequences. The integration of multiple explainability mechanisms from technical feature importance scores to natural language narrative generation enables different types of stakeholders to engage with AI outputs at appropriate levels of detail.

7.2. Enhancing National Cyber Resilience

The framework enhances national cyber resilience through several mechanisms. First, by enabling earlier detection of threats through automated pattern recognition and anomaly detection [8, 9], it reduces the time between attack initiation and defensive response. This temporal advantage is crucial, as many sophisticated attacks achieve their objectives within hours or days [4], while traditional manual analysis may take days or weeks [7].

Second, the framework improves situational awareness by aggregating and correlating threat intelligence across multiple sectors and organisations [13]. Individual organisations may observe isolated indicators that seem benign, but the framework can identify patterns indicating coordinated campaigns when viewing the broader landscape [11]. This holistic perspective is essential for defending against sophisticated adversaries who intentionally distribute attacks across multiple targets to avoid detection.

Third, the framework supports coordinated response by standardising threat classifications and automating stakeholder notification and escalation [33]. In complex national security environments with multiple agencies and organisations, coordination delays can significantly reduce response effectiveness. Automated coordination mechanisms reduce friction while maintaining appropriate oversight and control [24].

However, resilience enhancement is not solely a technical matter. The framework’s effectiveness depends on the quality and breadth of data inputs, the trust and cooperation of participating organisations [33], and the maturity of organisational processes and capabilities [6]. Technical capabilities alone cannot compensate for organisational or institutional weaknesses.

7.3. Comparison with Existing Approaches

The framework differs from the existing approaches in several key respects. Compared with traditional SIEM systems [16], which primarily focus on log aggregation and rule-based alerting, the framework emphasises adaptive machine learning, threat correlation across organisations, and policy-aware intelligence generation. While SIEMs require extensive manual configuration and tuning, the framework employs self-learning models that adapt to evolving threats.

Compared with commercial threat intelligence platforms, which typically serve individual organisations [13], the framework is explicitly designed for national-level governance, incorporating multi-stakeholder coordination [33], legal compliance mechanisms [22, 36], and policy alignment [23]. Commercial platforms often treat governance requirements as constraints rather than integral design considerations.

Academic research in AI-driven cybersecurity has produced numerous innovative detection techniques [8, 18], but often focuses on isolated technical problems without addressing governance integration. The framework bridges this gap by providing a comprehensive architecture that addresses both technical detection and governance requirements.

7.4. Comparative Analysis with Existing Frameworks (Table 5)

The comparative analysis indicates that the existing frameworks typically emphasise either technical detection capabilities or governance guidance. The proposed framework differs by integrating AI analytics, governance alignment, explainability, legal compliance, and coordinated response mechanisms within a unified architecture. This integration enables technical threat intelligence to be translated directly into governance-relevant decision support, thereby addressing a gap that remains insufficiently covered in the existing national cybersecurity frameworks.

7.5. Implementation Challenges

Despite its potential benefits, the framework faces significant implementation challenges that must be addressed for successful deployment.

7.6. Data-Sharing Barriers

Effective threat intelligence sharing requires organisations to overcome traditional barriers, including competitive concerns, legal restrictions, data sensitivity, and lack of trust [33]. Energy companies, for example, may be hesitant to share detailed security data with competitors or even government agencies. Legal frameworks may restrict data sharing across sectors or jurisdictions [37]. The framework addresses these challenges through privacy-preserving techniques [29] and explicit data governance mechanisms, but building trust and establishing appropriate legal frameworks remains a prerequisite that requires sustained effort.

7.7. Institutional Resistance to Automation

Organisations may resist increased automation in cybersecurity decision-making due to concerns about job displacement, loss of control, or lack of understanding of AI capabilities and limitations. Resistance may be particularly strong in government agencies where traditional procedures and human judgement have long been the norm [6]. Addressing this requires change management, training, and demonstration of value through pilot programmes and incremental deployment. The framework’s emphasis on human in the loop oversight [24] and explainability [12] can help address concerns while enabling gradual adoption.

7.8. Adversarial AI and Framework Robustness

The increasing use of AI within cybersecurity governance introduces new attack surfaces that adversaries may exploit. While AI enhances detection accuracy and situational awareness, machine learning models themselves can become targets of manipulation. Therefore, robustness against adversarial attacks must be considered a core design requirement rather than an optional enhancement.

7.9. Ethical and Legal Considerations

The framework operates in contexts where ethical and legal considerations are paramount [32]. Automated threat detection may raise concerns about surveillance, privacy infringement, and false positives, leading to unwarranted investigation or action, and potential for abuse. Legal frameworks vary across jurisdictions and may be unclear or evolving [22, 36]. The framework’s emphasis on privacy-preserving techniques [29], proportionality, due process, and transparency helps to address these concerns, but legal and ethical review should be an ongoing process rather than a one-time approval.

7.10. Resource Requirements

Implementing and operating the framework requires significant resources, including computing infrastructure, skilled personnel, data storage, and ongoing maintenance and development [7]. Smaller nations or organisations with limited resources may face challenges in deploying the full framework. However, the framework’s modular architecture enables incremental deployment, starting with core capabilities and expanding over time. Cloud computing and managed services can also help address resource constraints.

7.11. Opportunities and Future Directions

Despite challenges, the framework creates opportunities for advancing both technical cybersecurity capabilities and governance practices. The integration of XAI with governance requirements provides a model for other domains where AI systems must operate within legal and ethical constraints [12, 23]. The framework’s emphasis on transparency and accountability may help build public trust in AI applications for security purposes, which has been lacking in some contexts [32].

Future research directions include empirical validation of the framework through pilot deployments, comparative analysis across different national contexts and governance models, and development of standardised metrics and evaluation methodologies. The framework’s modular architecture also enables ongoing innovation, as new machine learning techniques, threat detection methods [8, 11], or governance mechanisms [23] can be integrated without requiring fundamental redesign.

The evolving threat landscape, particularly the increasing use of AI by adversaries, creates urgency for adaptive defensive capabilities. The framework provides a foundation for addressing these challenges while maintaining governance principles, but continuous adaptation and improvement will be essential as threats and technologies continue to evolve [10].