Bridging Governance and Empirical Threat Intelligence: An Integrated Framework for Cybersecurity in Smart Farming

Modern agriculture’s integration of Internet of Things (IoT), Industrial Control Systems (ICSs), and data analytics boosts productivity but introduces significant cybersecurity and data governance challenges. Existing scholarship is divided between policy-focused governance and technical attack analyses, hindering the development of comprehensive, enforceable defenses. This paper introduces an integrated framework that bridges normative data governance in smart farming (SF) with empirical, honeynet-derived threat intelligence. Drawing on the authors’ previous systematic review of SF data governance and a honeynet simulating agricultural IoT/ICS, the study maps governance challenges to quantitative attack indicators from honeynet logs, classifying each pairing as directly supported by telemetry, indirectly supported by telemetry, or not observable using the current methodology. The findings show that the services flagged as governance concerns face sustained attack pressure: the honeynet recorded brute-force attempts against SSH/Telnet on simulated irrigation controllers (149,000 events), connection and login attempts targeting SMB (Server Message Block) and MQTT (Message Queuing Telemetry Transport) on automated machinery (67,156), credential-guessing attempts against management services (14,937), and ICS protocol probes (11,532). Geographic and protocol distributions reveal that legacy industrial protocols and weakly authenticated management interfaces, both highlighted as governance concerns, constitute the primary attack surface. This evidence supports a tiered governance model integrating protocol-level controls, identity governance, and data-sharing policy, demonstrating that effective SF cybersecurity requires empirically calibrated rather than purely policy-driven frameworks. The proposed framework offers actionable guidance for aligning technical defenses with data governance obligations. This work contributes a new methodological protocol (cross-evidentiary mapping), an empirically calibrated tiered framework, and a coherent research agenda at the intersection of governance and measurement, serving as a template for similar analyses in other critical infrastructure sectors.