Cyber resilience skills for AI-enabled incident response in port operations

• Reframes cyber incident response in ports as a portfolio of decision-oriented managerial skills rather than system performance. • Uses a two-round Delphi study with Thai domain experts to validate six cyber resilience skill domains for the Respond phase. • Shows that effective AI-enabled response depends on human interpretation, coordination, and accountable decision-making during disruption. • Bridges AI-enabled cybersecurity research and port operations by formalizing the human–AI governance layer in incident response. • Extends port resilience literature by making the Respond phase analytically explicit and skill-based. Ports are increasingly deploying artificial intelligence (AI) to support cybersecurity monitoring, analysis, and automated response. While prior research has focused on the technical performance of AI-enabled response systems, far less attention has been given to the human skills required to govern cyber incident response during active disruption. In port environments—where cyber incidents can immediately affect safety, cargo flows, and service continuity—response effectiveness depends not only on automation, but on managerial judgment exercised under time pressure and uncertainty. This study reframes cyber incident response capability as a set of decision-oriented skills enacted by port operations managers during the Respond phase. Using a two-round Delphi method with experts from port operations, cybersecurity, and governance fields in Thailand, the study identifies and validates six core cyber resilience skill domains: Operational Impact Interpretation; Response Coordination and Order-of-Operations Leadership; Criteria-Based Reporting and Stakeholder Communication; Containment–Continuity Trade-off Management; Human–AI Supervision and Decision Governance; and Learning and Response Improvement. The findings advance cyber resilience and port management literature by making the human governance layer of AI-enabled response analytically explicit. The resulting skill framework provides a foundation for future empirical research and offers practical guidance for training, role design, and policy development in AI-enabled port cybersecurity governance.