Cybersecurity Analytics for the Enterprise Environment: A Systematic Literature Review

The escalating scale and sophistication of cyber threats compel enterprises to urgently adopt data-driven security analytics. This systematic literature review, adhering to the PRISMA protocol, rigorously synthesizes current knowledge by analyzing 65 peer-reviewed studies (2013–2023) from six major databases on enterprise-level cybersecurity analytics. Our findings reveal a significant industry-wide transition from traditional signature-based tools towards advanced cloud-enabled, big-data and artificial intelligence-powered techniques, where machine learning and graph-based models are increasingly prominent in recent works. While large organizations in finance, Information and Communication Technology, and critical utilities spearhead adoption, dedicated research focusing on small and medium-sized enterprises (SMEs) remains notably limited. Ten thematic observations encapsulate key adoption drivers, an evolving preference for proactive and predictive security strategies, the critical role of heterogeneous log and network data, and persistent implementation challenges-notably data integration, skills shortages, and cost. Furthermore, this review identifies crucial open research avenues, including the development of real-time scalable analytics, unified policy languages, and critically needed SME-oriented solutions. Collectively, these insights provide a robust evidence base to inform future research trajectories and guide the practical deployment of effective cybersecurity analytics in diverse enterprise settings.