Little is known about how organizations leverage business analytics (BA) to develop, process, and exploit analytical information in cybersecurity incident response (CSIR). Drawing on information processing theory (IPT), we conducted a field study using a multiple case study design to answer the following research question: How do organizations exploit analytical information in the process of cybersecurity incident response by using business analytics? We developed a theoretical framework that explains how organizations respond to the dynamic cyber threat environment by exploiting analytical information processing capability in the CSIR process. This, in turn, leads to positive outcomes in enterprise security performance, delivering both strategic and financial benefits. Our findings contribute to the BA and cybersecurity literature by providing useful insights into BA applications and the facilitation of analytics-driven decision making in CSIR. Further, they contribute to IPT by providing new insights about analytical information needs, mechanisms to seek analytical information, and analytical information use in the process of CSIR.

对于组织如何利用业务分析（BA）开发，处理和利用网络安全事件响应（CSIR）中的分析信息知之甚少。基于信息处理理论（IPT），我们使用多案例研究设计进行了实地研究，以回答以下研究问题：组织如何在网络安全事件响应过程中通过使用业务分析来利用分析信息？我们开发了一种理论框架，该框架解释了组织如何通过在CSIR流程中利用分析信息处理能力来应对动态网络威胁环境。反过来，这又在企业安全性能方面带来了积极的成果，同时带来了战略和财务利益。我们的发现通过提供对BA应用程序的有用见解以及在CSIR中促进分析驱动的决策制定，为BA和网络安全文献做出了贡献。此外，它们通过提供有关分析信息需求的新见解，寻求分析信息的机制以及CSIR过程中分析信息的使用，为IPT做出了贡献。