Advancing risk management with cybersecurity intelligence: a design science approach

Purpose Cyber threat intelligence (CTI) and risk management (RM) remain fragmented across tools, formats and governance processes, limiting interoperability and consistent decision-making. This study aims to develop unified risk and intelligence messaging (URIM), a governance-oriented artifact that standardizes risk and intelligence communication across heterogeneous organizational contexts. Design/methodology/approach Following design science research (DSR), the authors elicited requirements from cybersecurity professionals. A pilot study refined the survey instrument, followed by a qualitative survey using purposive and snowball sampling. Thematic analysis informed the URIM artifact specification, which was appraised through a qualitative ex ante expert review, with recommendations registered for subsequent cycles. Findings Three recurring barriers to effective cyber risk governance emerged: fragmented toolchains, limited data interoperability and inconsistent governance practices. Participants highlighted vendor lock-in, incompatible protocols and weak standardization as constraints on intelligence sharing. They supported a vendor-neutral approach combining canonical governance messages, semantic alignment and modular compliance features. Originality/value URIM extends cybersecurity governance research by providing a user-informed, model-level DSR artifact that links CTI and RM through standardized governance messaging and explicit interface specifications. It makes interoperability requirements explicit by defining canonical messages and semantic alignment rules that existing CTI-sharing and RM approaches often leave implicit.