This study aims to develop an emergent supply chain cyber risk and resilience (SCCRR) framework, grounded in supply chain network theory (SCNT), to identify and prioritise critical cyber supply chain risks and critical resilience-enabling factors.
A multiple-case study methodology was adopted across four organisations operating in the food, pharmaceutical and logistics sectors. The framework integrates insights from extant literature and generative AI-assisted exploratory analysis. Qualitative data were analysed using template analysis, while quantitative prioritisation used multi-criteria decision-making techniques. Cross-case analysis enhanced analytical robustness and generalisability.
The results identify key strategies for strengthening SCCRR adoption, including integrating cybersecurity practices into supply chain operations, enhancing cross-sector collaboration for threat intelligence sharing and deploying advanced monitoring systems to detect vulnerabilities. The findings further reveal that organisations with lower levels of SCCRR integration exhibit weaker adaptive capacity, highlighting areas where targeted investments, such as vendor audit protocols, crisis management training, and decentralised security architectures, deliver the most significant network-wide benefits.
The study provides managers with actionable, decision-support insights to prioritise cyber resilience investments across supply networks. The framework supports evidence-based decision-making by linking cyber risks, resilience capabilities and strategic interventions.
This research advances SCNT-based resilience theory by operationalising cyber risk and resilience through an empirically grounded, decision-oriented framework. It contributes to practice-relevant supply chain research by translating theory-driven network analysis into implementable managerial tools within real-world organisational contexts.
