Empowering Boards through Continuous, Empirically Generated Cybersecurity Patterns Using a Criminological-informed Analytical Tool

As boards face increasing regulatory pressure to strengthen organizational cybersecurity, there is a need for methods that support evidence-based, informed decision-making. By analyzing cyber risks from a criminology perspective, this study addresses the challenges boards face in managing cyber threats. Using Crime Script Analysis and Situational Crime Prevention, we systematically examined Singapore’s regulatory data breach reports to identify cybersecurity patterns, describe them in a business process context, and provide actionable guidance aligned with ISO/IEC 27002:2022 controls. We explored the automation of this approach using large language models and manually analyzed the result, identifying the top three patterns and visualizing them in a dashboard: Authentication deficiencies, Supplier management risks, and Access control failures. Despite frequent attention, these areas remain ineffectively addressed in practice. This study also offers research opportunities in the continuous generation of empirical cybersecurity insights, assisting boards to facilitate better cybersecurity management in line with regulatory and compliance responsibilities.