Research Methodologies for Cybersecurity in Enterprise Environments: A Narrative Review, Synthesis and Executable Guide

• URL: http://arxiv.org/abs/2608.24850v1
• Date: Tue, 25 Aug 2026 17:38:00 GMT
• Title: Research Methodologies for Cybersecurity in Enterprise Environments: A Narrative Review, Synthesis and Executable Guide
• Abstract summary: This paper provides a narrative review and synthesis of methodological practices across a verified corpus of 151 works.<n>We organise these practices into eleven methodology families, detailing for each what questions it answers, the strength of its supporting evidence, and its common failure modes.<n>Every protocol is also visually mapped to make the sequence, decisions, and threats legible at a glance.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Enterprise cybersecurity research draws on a wider range of methods than any single community routinely teaches. Researchers face a selection problem before they face a technical one: a study may simultaneously need a systematic review, a design-science artifact, a controlled detection experiment, an interview study, or an attack-graph model. This paper addresses that problem in two ways. First, it provides a narrative review and synthesis of methodological practices across a verified corpus of 151 works. We organise these practices into eleven methodology families, detailing for each what questions it answers, the strength of its supporting evidence, and its common failure modes. Second, we convert each family into an executable protocol comprising ordered steps, required instruments, evaluation criteria, common validity threats, and a reporting checklist. Every protocol is also visually mapped to make the sequence, decisions, and threats legible at a glance. We also treat contradictions in the literature as evidence. For example, reported rankings of intrusion-detection algorithms are wildly inconsistent across individually careful studies. We argue this pattern is most parsimoniously explained by variations in evaluation design rather than the algorithms themselves, as these studies differ in design dimensions known to shift results by more than the margins separating the algorithms. Ultimately, the evidence supports methodological pluralism disciplined by explicit validity reasoning. We conclude that researchers must match their evaluation design to the decision under study, triangulate technical against organisational evidence, explicitly state the population a result generalises to, and report the conditions under which the result would not hold.

Related papers

• Personalized Auto-Research: Towards a True AI Co-Scientist [90.01790420664169]
  Given a research goal, state-of-the-art systems remain researcher-agnostic.<n>What counts as novel, valuable, or feasible depends on the researcher.<n>We propose a framework that threads a graph-grounded researcher context through retrieval, hypothesis search, experimentation, writing, and review.
  arXiv  Detail & Related papers  (2026-08-14T20:43:27Z)
• ECLAIR: A Causally-Grounded AI Framework for Scientific Discovery in Empirical Software Engineering [51.19819833971252]
  This paper introduces ECLAIR, a causally grounded AI framework that integrates Large Language Models into every stage of the scientific process.<n>ECLAIR treats LLMs as active scientific agents operating under the principles of causal inference.
  arXiv  Detail & Related papers  (2026-08-03T14:47:03Z)
• Validity Threats for Foundation Model Research [19.108459045725617]
  Controlled experiments are the backbone of machine learning research.<n>However, at the scale of modern foundation models, they have become prohibitively expensive.<n>Instead, the community increasingly relies on research strategies that approximate the ideal experiment at a fraction of the cost.
  arXiv  Detail & Related papers  (2026-06-03T15:57:42Z)
• AI for Auto-Research: Roadmap & User Guide [107.0834449839233]
  We present an end-to-end analysis of AI across the complete research lifecycle.<n>We identify a sharp, stage-dependent boundary between reliable assistance and unreliable autonomy.<n>We show that greater automation can obscure rather than eliminate failure modes.
  arXiv  Detail & Related papers  (2026-05-18T17:08:26Z)
• Exploring the Garden of Forking Paths in Empirical Software Engineering Research: A Multiverse Analysis [3.6324565773746147]
  We conduct a so-called multiverse analysis on a published empirical SE paper.<n>We identify nine pivotal analytical decisions with at least one equally defensible alternative.<n>The overwhelming majority produced qualitatively different, and sometimes even opposite, findings.
  arXiv  Detail & Related papers  (2025-12-09T18:47:00Z)
• False Sense of Security: Why Probing-based Malicious Input Detection Fails to Generalize [30.448801772258644]
  Large Language Models (LLMs) can comply with harmful instructions, raising serious safety concerns despite their impressive capabilities.<n>Recent work has leveraged probing-based approaches to study the separability of malicious and benign inputs in LLMs' internal representations.<n>Motivated by poor out-of-distribution performance, we hypothesize that probes learn superficial patterns rather than semantic harmfulness.
  arXiv  Detail & Related papers  (2025-09-04T05:15:55Z)
• A Discrepancy Aware Framework for Robust Anomaly Detection [51.710249807397695]
  We present a Discrepancy Aware Framework (DAF), which demonstrates robust performance consistently with simple and cheap strategies. Our method leverages an appearance-agnostic cue to guide the decoder in identifying defects, thereby alleviating its reliance on synthetic appearance. Under the simple synthesis strategies, it outperforms existing methods by a large margin. Furthermore, it also achieves the state-of-the-art localization performance.
  arXiv  Detail & Related papers  (2023-10-11T15:21:40Z)
• SoK: Machine Learning for Misinformation Detection [0.8057006406834466]
  We examine the disconnect between scholarship and practice in applying machine learning to trust and safety problems.<n>We survey literature on automated detection of misinformation across a corpus of 248 well-cited papers in the field.<n>We conclude that the current state-of-the-art in fully-automated detection has limited efficacy in detecting human-generated misinformation.
  arXiv  Detail & Related papers  (2023-08-23T15:52:20Z)
• SoK: Privacy-Preserving Data Synthesis [72.92263073534899]
  This paper focuses on privacy-preserving data synthesis (PPDS) by providing a comprehensive overview, analysis, and discussion of the field. We put forth a master recipe that unifies two prominent strands of research in PPDS: statistical methods and deep learning (DL)-based methods.
  arXiv  Detail & Related papers  (2023-07-05T08:29:31Z)
• Neural Causal Models for Counterfactual Identification and Estimation [62.30444687707919]
  We study the evaluation of counterfactual statements through neural models. First, we show that neural causal models (NCMs) are expressive enough. Second, we develop an algorithm for simultaneously identifying and estimating counterfactual distributions.
  arXiv  Detail & Related papers  (2022-09-30T18:29:09Z)
• Comprehensive Studies for Arbitrary-shape Scene Text Detection [78.50639779134944]
  We propose a unified framework for the bottom-up based scene text detection methods. Under the unified framework, we ensure the consistent settings for non-core modules. With the comprehensive investigations and elaborate analyses, it reveals the advantages and disadvantages of previous models.
  arXiv  Detail & Related papers  (2021-07-25T13:18:55Z)
• Adjusting for Confounders with Text: Challenges and an Empirical Evaluation Framework for Causal Inference [15.506820260229256]
  Causal inference studies using textual social media data can provide actionable insights on human behavior. No empirical evaluation framework for causal methods using text exists. Our framework enables the evaluation of any casual inference method using text.
  arXiv  Detail & Related papers  (2020-09-21T15:38:45Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.