Laura Amo, University at Buffalo, State University of New York

Richard Baskerville, Georgia State University

Rui Chen, Iowa State University

Matthew Hashim, University of Arizona

Yaojie (William) Li, University of New Orleans

Yuan Li, University of Tennessee at Knoxville

As automation and AI explode, artificial intelligence is positioned to become the primary force in offensive and defensive cybersecurity practices. Attackers use generative AI to launch sophisticated spear-phishing attacks and deepfake campaigns targeting individuals; they also leverage Internet-of-Behaviors data to customize attacks based on user behavior patterns. AI companionship tools, while offering emotional support and practical assistance, also pose significant security and privacy concerns. Defensively, practitioners increasingly rely on AI-based threat detection tools just to keep pace with AI-fueled external threats, simultaneously facing cognitive issues associated with AI-based cybersecurity incident responses.

With AI driving cybersecurity from both offensive and defensive angles, it seems important to remember that security is fundamentally a human phenomenon. Human-in-the-loop is a well-established design principle emphasizing human involvement in system training, tuning, and decision making to improve accuracy and safety. This approach addresses contexts where human performance of security-critical functions is imperative because fully automated systems may be restrictive, inconvenient, or dangerous. Applied to security, HITL also guides designers and operators in identifying and mitigating human errors that cause security failures, premised on the notion that humans are the weakest link. Humans are thus a necessary yet vulnerable link in the security chain.

In this special issue of Information Systems Frontiers, we invite IS security researchers to consider how to balance AI's inevitable role in the future of information security while keeping humans such as users, employees, clients, patients, and students in the loop as a research focus. As security becomes increasingly AI-oriented, behavioral IS scholarship faces a growing challenge to retain focus on human behavior, cognition, and motivation. Now more than ever, it is imperative that humans remain central to research on secure systems, training programs, and assistive technologies such as chatbots.

This special issue will consist of papers from two sources: the best submissions from an open call for papers selected on a competitive basis, and invited submissions that are substantial revisions of selected papers accepted at the 2026 Dewald Roode Workshop on Information Systems Security Research. If from the latter, the submitted manuscript is required to have more than 40% new and original technical or scientific content, distinct from the workshop paper. Authors will be required to submit a letter detailing the differences between the workshop paper and the version submitted to this special issue.

Potential topics

• Neurosecurity (NeuroIS) investigations of information security behavior
• Behavioral analyses of design science treatments enhancing or balancing security and privacy tradeoffs
• The behavioral intersection of cybersecurity/privacy research and AI/ML advancements
• AI-enabled security awareness, training, nudging, and behavioral intervention systems
• Human-AI collaboration in security decision-making, compliance, monitoring, and response
• Behavioral security implications of generative AI, including phishing, social engineering, misinformation, insider threats, and user overreliance on AI tools
• Design science approaches to developing, evaluating, and theorizing intelligent security artifacts with behavioral implications
• Adaptive, personalized, and context-aware security interventions enabled by AI and analytics
• Theoretical extensions or reconceptualizations of established behavioral security theories in AI-mediated environments
• Security behaviors in pervasive and post-pandemic work environments, including remote work, hybrid work, IoT, cloud platforms, and platform ecosystems

Timeline

• January 15, 2027: Submission deadline
• May 15, 2027: Notification of first round reviews
• July 15, 2027: Revised manuscript due
• September 1, 2027: Notification of second round reviews
• October 15, 2027: Final version due
• January 30, 2028: Tentative publication date