Anomaly Detection as a Key Driver of Digital Forensic Resilience: Empirical Evidence from Critical Infrastructure Experts

Ensuring strategic resilience in critical infrastructures supported with a machine learning approach requires moving beyond compliance checklists and post-incident analysis toward proactive, intelligence-based approaches. This study introduces the Forensic Resilience Operational Model (FROM), a systems thinking framework designed to embed forensic intelligence into the resilience cycle of complex socio-technical systems. To quantify this integration, the study investigates the determinants of the extent to which four operational pillars (forensic readiness, anomaly detection, governance and privacy safeguards, and structured intelligence integration) affect forensic resilience, using empirical survey data from 212 cybersecurity professionals across critical infrastructure sectors. We deploy Partial Least Squares Structural Equation Modelling (PLS-SEM) to investigate these relationships, and the results confirm that anomaly detection is the strongest contributor to forensic resilience, followed by structured intelligence integration and forensic readiness. Governance safeguards, while comparatively weaker, provide the necessary legitimacy and assurance of compliance. Supported with sector-specific case studies in the maritime, financial, and CERT domains, the findings highlight both the adaptability of the proposed FROM and the operational constraints encountered in real-world contexts. The study contributes to the field of systems-oriented strategic management by demonstrating that, when systematically embedded, forensic intelligence enhances adaptive capacity, supports predictive decision-making, and strengthens resilience in environments characterized by uncertainty and high complexity.