Cybersecurity as Social Physics: How Collective Dynamics Shape Digital Resilience

Cybersecurity has long been treated as an engineering problem, a matter of patching software, hardening cryptographic protocols, and building better firewalls. A review published on 26 October 2026 in Frontiers in Physics argues that this view is no longer sufficient. Abadeela Bashir and The Anh Han of Teesside University, Zia Ush Shamszaman of King’s College London, and Matjaz Perc of the University of Maribor propose a framework they call the Social Physics of Cybersecurity, which treats digital security as a complex adaptive socio-technical system. In their account, security outcomes emerge from the interactions of attackers, defenders, users, organisations, regulators, and increasingly autonomous artificial intelligence agents, whose behaviours continuously adapt in response to one another. The review synthesises research on evolutionary game theory, network science, behavioural research, cyber economics, and human-AI interaction into a single multilevel perspective on how cyber ecosystems evolve.

The core claim is that phenomena such as attack propagation, cyber-risk contagion, cascading failures, and systemic resilience cannot be fully understood through static or purely technical analysis. Modern digital infrastructures are woven together through communication networks, cloud services, software dependencies, and supply chains, so local incidents can generate system-wide effects, as illustrated by large-scale supply-chain compromises and flaws in widely deployed software components. Because defensive measures trigger attacker adaptation, user behaviour shapes organisational risk, and regulatory interventions alter incentives on both sides, feedback loops operate across multiple temporal and organisational scales. Security, the authors argue, is an emergent property of collective interactions rather than a fixed characteristic of isolated systems. Cyber ecosystems also self-organise: without central coordination, attackers, defenders, users, and organisations adapt to changing conditions and collectively shape the long-term evolution of the environment they inhabit.

A central analytical tool in this framework is evolutionary game theory, which departs from classical game-theoretic models that assume fully rational actors with well-defined incentives. Real cyber actors operate under uncertainty, learn from experience, imitate successful strategies, and adapt to changing environments. Evolutionary models instead track how strategies spread, persist, or disappear over time through adaptation and selection. The mathematical backbone is replicator dynamics, in which the frequency of a strategy changes according to its relative payoff: strategies with higher payoffs increase in frequency while less successful ones decline. In an attacker-defender system, this links individual performance to population-level change, so that security states emerge from repeated adaptation rather than from a single optimal decision. The same theoretical machinery has long been used to explain cooperation and competition in biological and social systems, which is precisely the bridge to social physics that the review seeks to establish.

To make this concrete, the authors highlight an evolutionary attacker-defender model in which attackers and defenders are represented as two interacting populations whose strategy frequencies change according to their relative fitness. The analysis identifies four boundary equilibria, corresponding to combinations of attack and no-attack with defence and no-defence, together with a potential internal equilibrium. Published phase portraits show qualitatively different regimes: a defence-dominated state, a contested state in which attack and defence remain simultaneously active, and an unstable internal point with eigenvalues of opposite signs, indicating saddle behaviour, which separates evolutionary trajectories depending on their initial conditions. These equilibria depend on the underlying payoff parameters, so changes in attack cost, attack benefit, or defence effectiveness can reshape the equilibrium structure and the evolutionary regime. The authors note that the binary attack/no-attack formulation is a tractable baseline, and that extending the models to multiple competing strategies, such as exploitation, evasion, and persistence for attackers or authentication, intrusion detection, and moving-target defence for defenders, could reveal richer dynamics including strategy coexistence, invasion of rare strategies, and cycling or other non-convergent trajectories.

Many evolutionary models assume large, well-mixed populations in which all agents interact equally, but real cyber ecosystems are finite, heterogeneous, and highly structured. Finite-population models account for stochastic effects that become important in realistic settings. Moran processes and related stochastic evolutionary models allow researchers to analyse fixation probabilities, estimate the likelihood that a strategy spreads through a population, and identify conditions under which rare behaviours become dominant. This matters because important defensive innovations often begin as minority strategies, with early adoption of multi-factor authentication, zero-trust architectures, and coordinated vulnerability disclosure given as examples. A commonly used pairwise comparison rule, the Fermi function, assigns a probability to adopting a neighbouring strategy according to the payoff difference, with a parameter controlling the strength of selection: weak selection makes updating nearly random, while stronger selection favours higher-payoff strategies. In the rare-mutation limit, repeated stochastic updates form a Markov chain whose stationary distribution gives the long-run probability of observing each cyber state, connecting individual social learning to the persistence of collective security states.

Network structure adds a further layer of complexity. Organisations, devices, and users are embedded within communication and dependency networks whose topology can strongly influence cyber outcomes. Scale-free networks contain highly connected hubs that can accelerate both attack propagation and defensive information sharing, while small-world networks can facilitate rapid diffusion while maintaining local clustering. Enterprise environments frequently exhibit layered and hierarchical structures that shape the movement of attackers and defenders. The review also argues that static topology captures only part of the picture: real cyber ecosystems are temporal, with users and devices joining or leaving, communication links appearing and disappearing, and attack surfaces repeatedly reconfigured, and temporal network models can capture how the timing and ordering of interactions influence contagion and control. Beyond pairwise links, higher-order networks such as hypergraphs can represent group interactions in organisation-wide security coordination, supply-chain defence, and multi-agent AI systems, where recent evolutionary game research shows that higher-order interactions can alter the conditions and pathways through which collective strategies emerge and persist. Certain structures promote cooperative defence through network reciprocity, which can suppress persistent attacks and expand the region of secure outcomes, whereas others facilitate insecure practices by isolating communities or concentrating vulnerabilities in critical hubs.

Among the most striking contributions of the social-physics perspective is the concept of tipping points. Complex systems often exhibit critical transitions in which gradual changes accumulate until a threshold is crossed, triggering abrupt shifts in behaviour. The adoption of security technologies provides a clear illustration: multi-factor authentication delivers limited benefits when adopted by only a small fraction of users, but once adoption exceeds a critical threshold, credential-based attacks may become substantially less profitable, leading to rapid reductions in successful compromises. Similar dynamics can arise in patch uptake, where collective adoption dramatically reduces exploitation opportunities. Threats exhibit tipping-point behaviour too: ransomware campaigns rely on network effects and behavioural contagion, and small increases in attacker capabilities, automation, or vulnerability prevalence can trigger rapid transitions from isolated incidents to widespread outbreaks. A simple payoff comparison in the review shows that when the expected benefit of attacking a defended system falls below its cost, with the condition depending on attack cost, attack benefit, and defence effectiveness, attack becomes evolutionarily unattractive, shifting the population from attack persistence towards non-attacking behaviour. Under fixed parameters, the unstable internal equilibrium separates evolutionary basins of attraction, while changes in payoffs can reshape those basins.

Human behaviour and human-AI interaction form another pillar of the framework. Many cybersecurity incidents originate from human decisions made under uncertainty, balancing convenience, trust, perceived risk, and cognitive effort, and secure and insecure behaviours spread through populations via social learning, imitation, and peer effects in ways analogous to information and infectious diseases. The growing deployment of AI transforms cybersecurity into a hybrid human-AI ecosystem: AI systems assist with threat detection, vulnerability analysis, incident response, and monitoring, while attackers use AI to automate reconnaissance, generate phishing content, and identify vulnerabilities at scale. Trust in AI is not static but evolves through repeated interactions, with excessive trust producing automation bias and insufficient trust preventing organisations from benefiting from AI capabilities. The review describes cybersecurity as increasingly involving three interacting populations of attackers, defenders, and AI agents, whose changes feed back into one another. It also highlights a timescale mismatch: automated AI systems may update within seconds or minutes, whereas human users, organisational processes, and regulators adapt over hours, months, or years, creating transient vulnerabilities even when appropriate defensive capabilities exist. Collective intelligence, combining human contextual reasoning with machine speed and scalability, is promising but not guaranteed, since poor coordination, biased decision-making, and over-reliance on automation can undermine both.

Economic and regulatory dynamics complete the picture. Security investments are constrained by limited resources, and because attackers and defenders respond strategically to investment decisions, cybersecurity exhibits economic dynamics that evolve over time. Weak security in one organisation can increase risks for connected partners, customers, or critical infrastructures, creating security externalities in which local decisions generate system-wide consequences and encouraging free-riding, where organisations rely on others to invest while limiting their own expenditure. Finite-population analysis further shows that unequal access to advanced defence capabilities can change evolutionary outcomes, since high-cost defensive strategies may remain difficult to adopt even when they provide stronger protection, while committed defenders and targeted subsidies can shift populations towards safer states. Cyber insurance redistributes rather than eliminates risk, and correlated attacks may produce simultaneous losses that challenge the stability of insurance systems. Regulation, from a social-physics standpoint, acts as an external force that influences the evolution of cyber ecosystems, and effective governance should encourage adaptive learning, cooperation, and information sharing while remaining flexible enough to respond to rapidly evolving threats.

The review synthesises these threads into a micro-meso-macro framework. At the micro level, heterogeneous actors learn, adapt, cooperate, and compete under uncertainty; at the meso level, these interactions become embedded in networks whose structure, temporality, and higher-order organisation shape the diffusion of attacks, trust, and security practices; at the macro level, the accumulation of local interactions produces attack propagation, contagion, cascading failures, and critical transitions that can lead towards resilience or systemic collapse. The authors identify priorities for future work, including empirically validated evolutionary models calibrated against real-world cyber data, integrated models of contagion and cascading failures, temporal and higher-order network representations, and studies of how delegation, oversight, and AI autonomy alter evolutionary dynamics, with the distribution of agency itself treated as an evolving property of the ecosystem. Their conclusion is that cybersecurity should ultimately be understood as a social-physical phenomenon, whose behaviour emerges from interacting populations of human and artificial agents embedded within complex socio-technical networks, and that establishing this interdisciplinary paradigm offers a foundation for understanding, predicting, and governing the resilient digital societies of the future.

Subject of Research: A review proposing social physics as a unifying framework for cybersecurity as a complex adaptive socio-technical system

Article Title: Social physics of cybersecurity

Article References: Bashir, A., Shamszaman, Z. U., Perc, M., & Han, T. A. (2026). Social physics of cybersecurity. Frontiers in Physics, 14, Article 1984375. https://doi.org/10.3389/fphy.2026.1984375

Image Credits: AI Generated

DOI: 10.3389/fphy.2026.1984375

Keywords: cybersecurity, social physics, evolutionary game theory, complex adaptive systems, network science, cyber resilience, human-AI interaction, systemic cyber risk, tipping points, behavioral cybersecurity, cyber economics, attacker-defender co-evolution