Patching the Invisible Gap: A Comparative Analysis of Cyber Defense Strategies in Indonesian Digital Enterprises
TL;DR
It is argued that the primary vulnerability of digital enterprises lies not only in the infrastructure layer but also in the gap between formal cybersecurity policies and their actual implementation in organizational practices, which indicates that most studies continue to emphasize isolated technical solutions, while internal user behavior as a critical cybersecurity risk factor remains underexplored.
Abstract
Over the past five years, hacking incidents targeting Indonesia’s digital business ecosystem have increased significantly. The National Cyber and Crypto Agency (Badan Siber dan Sandi Negara [BSSN]) recorded more than 1.6 billion cyberattacks throughout 2021, while 311 data breach incidents affecting 248 stakeholders were reported in 2022. However, this increase in cyber incidents has not necessarily been accompanied by a shift in the paradigm of cybersecurity research, as much of the existing literature continues to focus primarily on technical aspects. This study aims to analyze and compare approaches from previous research in mapping cybersecurity strategies for digital enterprises, particularly within the contexts of e-commerce, fintech, and local Software-as-a-Service (SaaS) platforms. Using a systematic literature review (SLR) method based on the PRISMA protocol, this study analyzed 34 articles obtained from the Scopus, IEEE Xplore, and Google Scholar databases published between 2019 and 2024. The findings identify a conceptual gap between technology-oriented approaches and integrated cybersecurity approaches that incorporate human and process dimensions through the people-process-technology framework. The results indicate that most studies continue to emphasize isolated technical solutions, while internal user behavior as a critical cybersecurity risk factor remains underexplored. This study argues that the primary vulnerability of digital enterprises lies not only in the infrastructure layer but also in the gap between formal cybersecurity policies and their actual implementation in organizational practices.