Cyber Team Performance: A Systematic Literature Review

Teams in cybersecurity operations, software engineering, and competitive gaming face technology-mediated collaboration, distributed coordination, and temporal pressure that challenge traditional team models. These models were developed in co-located, stable contexts; their applicability to dynamic, adversarial cyber environments has not been assessed through a systematic cross-domain synthesis. Without systematic evidence, practitioners and researchers lack guidance on which frameworks to apply, adapt, or develop for cyber-specific contexts. This PRISMA-guided systematic review synthesizes 137 studies (2015-2025), yielding 148 domain assignments across cybersecurity (n=30), software engineering (n=114), and e-gaming (n=4, exploratory), with 11 studies spanning multiple domains. Both reviewers independently extracted and coded all 137 studies. Quality was appraised using MMAT 2018, with 79.6% of studies meeting all applicable criteria. Communication, coordination, leadership, trust, and shared mental models are consistently reported as correlates of performance across domains. Distributed work, temporal pressure, and adversarial dynamics frequently necessitate model adaptation rather than direct application. Only 35% (48 of 137) of reviewed studies explicitly applied a formal team effectiveness model, with hybrid and context-adapted frameworks dominating practice. The synthesis identifies recurring adaptation strategies: temporal rescaling (IMOI), structural flexibility (Hackman), competency supplementation (Big Five), and stage compression (Tuckman) represent the most prevalent patterns identified across the corpus. Across the reviewed literature, team effectiveness models remain applicable when treated as adaptable analytical frameworks rather than fixed prescriptions. However, cross-domain generalization is constrained by the dominance of software engineering evidence (77% of domain assignments) and the sparse e-gaming base (n=4).