Laura Amo, University at Buffalo, State University of New York

Richard Baskerville, Georgia State University

Rui Chen, Iowa State University

Matthew Hashim, University of Arizona

Yaojie (William) Li, University of New Orleans

Yuan Li, University of Tennessee at Knoxville

As automation and AI explode, artificial intelligence is positioned to become the primary force in offensive and defensive cybersecurity practices. Attackers use generative AI to launch sophisticated spear-phishing attacks and deepfake campaigns targeting individuals; they also leverage Internet-of-Behaviors data to customize attacks based on user behavior patterns. AI companionship tools, while offering emotional support and practical assistance, also pose significant security and privacy concerns. Defensively, practitioners increasingly rely on AI-based threat detection tools just to keep pace with AI-fueled external threats, simultaneously facing cognitive issues associated with AI-based cybersecurity incident responses.

With AI driving cybersecurity from both offensive and defensive angles, it seems important to remember that security is fundamentally a human phenomenon. Human-in-the-loop is a well-established design principle emphasizing human involvement in system training, tuning, and decision making to improve accuracy and safety. This approach addresses contexts where human performance of security-critical functions is imperative because fully automated systems may be restrictive, inconvenient, or dangerous. Applied to security, HITL also guides designers and operators in identifying and mitigating human errors that cause security failures, premised on the notion that humans are the weakest link. Humans are thus a necessary yet vulnerable link in the security chain.

In this special issue of Information Systems Frontiers, we invite IS security researchers to consider how to balance AI's inevitable role in the future of information security while keeping humans such as users, employees, clients, patients, and students in the loop as a research focus. As security becomes increasingly AI-oriented, behavioral IS scholarship faces a growing challenge to retain focus on human behavior, cognition, and motivation. Now more than ever, it is imperative that humans remain central to research on secure systems, training programs, and assistive technologies such as chatbots.

This special issue will consist of papers from two sources: the best submissions from an open call for papers selected on a competitive basis, and invited submissions that are substantial revisions of selected papers accepted at the 2026 Dewald Roode Workshop on Information Systems Security Research. If from the latter, the submitted manuscript is required to have more than 40% new and original technical or scientific content, distinct from the workshop paper. Authors will be required to submit a letter detailing the differences between the workshop paper and the version submitted to this special issue.

Potential topics

• Neurosecurity (NeuroIS) investigations of information security behavior
• Behavioral analyses of design science treatments enhancing or balancing security and privacy tradeoffs
• The behavioral intersection of cybersecurity/privacy research and AI/ML advancements
• AI-enabled security awareness, training, nudging, and behavioral intervention systems
• Human-AI collaboration in security decision-making, compliance, monitoring, and response
• Behavioral security implications of generative AI, including phishing, social engineering, misinformation, insider threats, and user overreliance on AI tools
• Design science approaches to developing, evaluating, and theorizing intelligent security artifacts with behavioral implications
• Adaptive, personalized, and context-aware security interventions enabled by AI and analytics
• Theoretical extensions or reconceptualizations of established behavioral security theories in AI-mediated environments
• Security behaviors in pervasive and post-pandemic work environments, including remote work, hybrid work, IoT, cloud platforms, and platform ecosystems

Timeline

• January 15, 2027: Submission deadline
• May 15, 2027: Notification of first round reviews
• July 15, 2027: Revised manuscript due
• September 1, 2027: Notification of second round reviews
• October 15, 2027: Final version due
• January 30, 2028: Tentative publication date

Jason Chan, University of Minnesota

Alan Dennis, Indiana University

Daniel Gozman, The University of Sydney

Kalle Lyytinen, Case Western Reserve University

Critical National Infrastructure (CNI) encompasses essential systems and services that are vital for societal stability, economic security, and national safety. The increasing digitalization of these infrastructures has introduced unprecedented efficiencies that have transformed economies, enabling faster service delivery, improved public safety, reduced corruption, and enhanced crisis response through data sharing and analytics.

The United Nations Development Programme (UNDP) supports digital public infrastructure (DPI) as a driver for financial inclusion, social protection, and governance reforms. Digital advancements have also driven sustainability, with smart grids, environmental monitoring, and optimized resource management with potential for reducing carbon footprints and increasing resilience.

Furthermore, technological innovation in financial services, transportation, and energy has the potential to stimulate economic growth through enabling new business models. While the increasing digitalization of Critical National Infrastructure has introduced efficiencies, it also created unprecedented vulnerabilities, including cyberattacks, cascading failures, and systemic interdependencies that amplify risks.

Recognizing these challenges, governments in the UK, US, and Australia have developed regulatory frameworks such as the UK’s National Cyber Security Strategy, the US Cybersecurity and Infrastructure Security Agency (CISA) guidelines, and Australia’s Security of Critical Infrastructure Act (SOCI Act) to enhance resilience and mitigate emerging threats.

CNI spans multiple critical sectors, each with unique security and operational challenges, including energy and utilities, telecommunications and information networks, financial services and payments, healthcare and public health, transportation and logistics, emergency services and law enforcement, and government and public sector infrastructure.

As efforts to build CNIs have accelerated, issues around CNI security, resilience, and adaptability are becoming increasingly critical. At the same time significant research gaps remain in cybersecurity practices at the system level, governance, integration and management of emerging technologies such as Autonomous Driving Systems, and threat intelligence sharing.

Addressing these gaps is essential for policymakers, businesses, and infrastructure operators to mitigate threats, optimize performance, and ensure long-term continuity.

This Special Section aims to advance research on the design, adoption, and impact of digital solutions and services critical in building CNI to enhance governance, economic development, and public service delivery and safeguard CNI. We invite interdisciplinary contributions that explore how digital technologies and services can enhance CNI or impose new risks and challenges for the operation of CNIs. Papers that do not explicitly address or theorize about CNI design and operation and their digital components will be returned without review.

Potential topics

• Emerging Technologies and Digital Transformation: Innovative technologies such as Artificial Intelligence, Digital Twins, Blockchain and IoT are transforming CNI, enabling predictive analytics, smart grids, and cyber-physical security enhancements.
• Cybersecurity, Resilience, and Risk Management: Cyber threats such as ransomware, insider attacks, and cyber-physical vulnerabilities continue to grow. Risk assessment frameworks and mitigation strategies are essential.
• Governance, Policy, and Public-Private Partnerships: CNI governance requires polycentric collaborative efforts between government agencies, private sector entities, and international stakeholders.

Timeline

• June 1, 2025: Expression of Interest: one-page abstract, optional
• January 31, 2026: Initial Submission Due
• May 31, 2026: Notification of First Round Decision
• September 30, 2026: 1st Resubmission Due
• January 31, 2027: Notification of Second Round Decision
• April 30, 2027: 2nd Resubmission Due
• June 15, 2027: Final Decision