Social physics of cybersecurity

Cybersecurity is increasingly recognised as a complex adaptive socio-technical system in which security outcomes emerge from the interactions of attackers, defenders, users, organisations, regulators, and autonomous artificial intelligence (AI) agents. These interactions generate adaptive feedback loops, strategic behaviour, information diffusion, and network effects that drive the evolution of cyber threats and defences. Consequently, phenomena such as attack propagation, cyber-risk contagion, cascading failures, and systemic resilience cannot be fully understood through static or purely technical perspectives. Although evolutionary game theory (EGT), complex systems science, network science, behavioural research, and cyber economics have each provided valuable insights, the literature remains fragmented, with no unified perspective for explaining cybersecurity as an evolving socio-technical ecosystem. This review develops the concept of Social Physics of Cybersecurity as an interdisciplinary perspective that brings these approaches together with human-AI interaction to explain how collective security outcomes emerge from adaptive interactions within interconnected cyber ecosystems. We synthesise research on attacker-defender co-evolution, finite and structured population dynamics, cyber contagion, critical transitions, systemic cyber risk, and the growing role of AI-enabled multi-agent systems. Building on these perspectives, we propose a unified multilevel view of cybersecurity that links individual strategic behaviour, network-level interactions, and system-wide resilience. We argue that cybersecurity should be understood as a social-physical phenomenon in which resilience and vulnerability emerge from the collective dynamics of interacting human and artificial agents. Finally, we identify key research opportunities for developing empirically grounded, data-driven, and AI-enabled models capable of predicting, analysing, and governing increasingly interconnected and autonomous cyber ecosystems.