Close Calls in Cyberspace: Strengthening Cybersecurity by Learning from Near‑Misses

Abstract

Organizations can improve their cybersecurity by learning from both incidents and success stories. These successes can, in many cases, be defined as ‘near-misses’, when a potentially successful attack is stopped just in time. However, it is unclear what can be categorized as a near-miss in cybersecurity. To bridge this gap, we define four distinct categories of near-misses in cybersecurity, along two axes of interest, being the locus of intervention (human or system) and the nature of the intervention (active or passive). We argue that understanding the workings of these near-misses can support organizations in improving their cybersecurity practices to build stronger futures. To do so, we outline a research agenda of questions and topics that require further examination to fully leverage the insights on near-misses in organizational cybersecurity.