Security fatigue, governance challenges and clashing organisational priorities are among the underexplored cybersecurity risks that could threaten digital twin networks, researchers have found.

Digital twins are digital replicas of the physical world that are increasingly being used to improve the efficiency and performance of real-world systems in sectors including transport, construction, manufacturing and healthcare.

But researchers for transport decarbonisation hub TransiT have identified a gap in cybersecurity research, where an overwhelming focus on the technical aspects of digital twinning has meant that cybersecurity challenges around organisations and their teams have been overlooked.

Research lead author Dr Stefanos Evripidou, a TransiT cybersecurity researcher at University of Glasgow, explained: “Cybersecurity is both a social and a technical challenge, because it involves people and organisational processes, as well as technology. These dimensions are inherently interdependent, so we need to understand the technical and the organisational challenges together rather than in isolation. But our research has found that very little is known about the kind of real-world cybersecurity issues that organisations face around the implementation of digital twins. It’s critical that we bridge this gap in knowledge – because digital twins are being scaled and connected to address increasingly complex challenges that span whole sectors or societies. And this means we’re also hugely expanding the attack surface, increasing exposure to cybersecurity threats.”

Evripidou and his team have detailed this gap in research and also propose a framework to help identify what further research is needed.

“Where cybersecurity has been the primary focus, works have been overwhelmingly technical, overlooking organisational complexities that affect cybersecurity in practice,” the researchers said.

Alongside technical challenges, like how to identify and repel cyber-attacks or get diverse systems to interoperate and share data, the research identified a series of non-technical challenges and organisational barriers.

These include how to get cyber security practitioners to collaborate when they have competing priorities, and how to avoid employees ignoring security policies because they conflict with their main job. These challenges may be amplified in digital twin contexts, where multiple stakeholders are involved in the development and operation of digital twins, creating additional governance and coordination challenges.

“Security often conflicts with other business practices, particularly when it adds additional workload, creating friction between security and productivity,” the researchers added. “This can result in security fatigue, where employees may adopt less demanding workarounds and more broadly, lead to security’s exclusion from the decision-making process.”

Other business-related challenges include financial constraints, lack of organisational commitment and ‘cultural inertia’ to digitalisation. Employees can also resist the adoption of digital twins because of fears about potential job losses. And shortages in digital and data-related skills is another major challenge.

While these and other topics are discussed separately in research related to digital twinning or cybersecurity, very few papers explore the two topics together.

“A key gap identified in our analysis is the limited research into how digital twin stakeholders understand cybersecurity and its associated risks in digital twins,” the researchers explained.

To address this, the paper sets out an agenda for future research, including high-level research questions that can be adapted to different settings and sectors.