Cybersecurity chatbots work best as assistants, not replacements, study finds

Cyber threats are becoming more automated and adaptive, and a new study argues that defending against them cannot be solved by algorithms alone. In research published in Discover Artificial Intelligence, Tianming Lu and Zongwen Xia combined a large-scale bibliometric mapping of a decade of literature with in-depth interviews to examine how artificial intelligence is used in cyber threat detection and how AI chatbots could support cybersecurity in practice. Their central conclusion is striking: chatbot-supported cybersecurity is valuable as a first-level assistant that warns users, explains risks, and escalates serious cases, but it should not be treated as a replacement for validated detection technologies or human security professionals.

The study used a sequential mixed-method design. The first stage was a bibliometric review of publications indexed in Scopus and the Web of Science Core Collection between 1 January 2016 and 30 April 2026, with the 2026 records representing only a partial publication year. After systematic screening reported through a PRISMA flow diagram, 2,015 eligible documents remained in the final dataset. The authors analyzed publication trends, contributing authors, countries, journals, citation patterns, and keyword clusters using VOSviewer, a widely used science-mapping tool. The second stage consisted of semi-structured interviews with 20 participants: 10 developers and 10 users of AI chatbot systems, selected through purposive sampling and analyzed with thematic analysis.

The bibliometric results revealed three major thematic clusters structuring the field. The first cluster centers on cybersecurity and threat-detection applications, with keywords such as cybersecurity, threat detection, blockchain, data privacy, and cyber-physical systems. The second cluster represents artificial intelligence and machine-learning detection methods, including phishing, malware, random forest, decision trees, feature selection, and natural language processing. The third cluster emphasizes data-mining-based network intrusion detection, linked to intrusion detection systems, the Internet of Things, networks, DDoS attacks, and anomaly detection. Together, the clusters show a field organized around cybersecurity applications, intelligent detection techniques, and data-driven network defense.

The country and author rankings highlight the global and uneven shape of the research landscape. India contributed the highest number of documents, with 968 publications, representing 42.33 percent of the total among the top 15 countries. The United States ranked second with 409 documents and 3,119 citations, while Australia, despite producing only 52 documents, achieved the highest citation impact at 58.69 citations per document. India also showed the strongest international collaboration, followed by the United States and the United Arab Emirates. Among authors, Sarker, Iqbal H. was the most productive with 9 documents and 1,178 citations, while Tihanyi, Norbert achieved the highest citation impact at 225 citations per document from only 2 papers, reflecting strong attention to work on cyber threat detection, IoT security, machine learning, and large language models.

Publication sources tell a similar story of an interdisciplinary field. IEEE Access was the dominant outlet, with 65 documents, 3,062 citations, and the highest total link strength of 10, indicating a central connecting role. Specialized and IoT-oriented journals such as Computers and Security, Computer Networks, Sensors, Internet of Things, and IEEE Communications Surveys and Tutorials also featured prominently, and some sources achieved high citation impact with very few papers. The authors note that the field combines artificial intelligence, data mining, network security, IoT security, and cyber-physical system protection, and that research is expanding from traditional rule-based security toward intelligent, automated, and adaptive detection approaches applied in cloud, edge, and distributed environments.

Yet the bibliometric analysis also exposed a critical gap: the literature is predominantly model-centered. Most studies emphasize algorithms, datasets, accuracy, precision, recall, false-positive rates, and system architecture, while far less attention goes to user experience, developer decision-making, trust, explainability, privacy concerns, ethical risk, and practical adoption. This gap motivated the qualitative stage. The interviews explored how AI chatbot-supported cybersecurity is designed, trusted, and used, comparing the perspectives of those who build such systems with those who interact with them in contexts such as online banking, IT support, e-commerce, healthcare apps, and government services.

The interview findings paint a nuanced picture of what cybersecurity chatbots can realistically do. According to the study, chatbots can provide rapid warnings about suspicious logins, unsafe links, and unusual account activity; explain why a message, website, or login attempt was classified as suspicious; support phishing identification; offer first-level incident-response guidance such as changing a compromised password or enabling multi-factor authentication; improve cybersecurity awareness through education; and escalate serious cases to human specialists. Developers described the chatbot not merely as a communication tool but as a user-facing interface connected to detection models, security data, and threat intelligence, whose value depends on the quality of the underlying model and data.

Participants also identified substantial concerns. Developers stressed that data quality is a major requirement for reliable detection, since poor-quality data, outdated attack patterns, and weak model generalization reduce effectiveness. False positives and false negatives remain central challenges: repeated false warnings can produce alert fatigue and erode trust, while missed attacks create a false sense of security. Users, meanwhile, did not trust chatbot advice automatically; their trust depended on accuracy, clarity, privacy protection, and prior experience, and vague or overly technical responses reduced confidence. Privacy concerns were strong, as users hesitated to share account details, browsing behavior, or security-related information with chatbots. Adversarial risks, including prompt manipulation and malicious input, and the danger of overreliance on automated advice rounded out the concerns.

From these combined findings, the researchers propose a human-centered framework for chatbot-supported cyber threat detection with six connected dimensions: a data foundation covering network logs, endpoint data, IoT signals, and threat intelligence; detection intelligence built on classification, clustering, anomaly detection, and machine learning; chatbot interaction as the communication bridge between detection systems and users; developer responsibility for model updating, adversarial testing, and secure integration; user acceptance grounded in trust, explainability, and privacy confidence; and governance with human oversight and continuous learning. The framework draws on the NIST AI Risk Management Framework’s principles that trustworthy AI should be valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced, and fair.

The authors are careful about the limits of their evidence. The bibliometric dataset was shaped by the chosen search terms, English-language restriction, and document types, and citation counts favor older publications; the 2026 totals should not be compared with complete calendar years. The qualitative sample of 20 purposively selected participants was designed for exploratory inquiry rather than statistical generalization, and the framework’s evaluation indicators were not quantitatively tested. Future research, they suggest, could use large-scale surveys and structural equation modeling to test the framework, and experiments to examine how users respond to different chatbot warning designs. For now, the study’s message is clear: effective AI-driven cybersecurity requires both technical reliability and human-centered design, with chatbots positioned as supportive communication and decision-assistance tools operating under explicit escalation thresholds, privacy controls, and human oversight.

Subject of Research: Human-centered AI-driven cybersecurity and chatbot-supported cyber threat detection examined through bibliometric and qualitative analysis

Article Title: Human centered artificial intelligence driven cybersecurity for business resilience using bibliometric and qualitative analysis

Article References: Lu, T., & Xia, Z. (2026). Human centered artificial intelligence driven cybersecurity for business resilience using bibliometric and qualitative analysis. Discover Artificial Intelligence, 6(1), Article 1637. https://doi.org/10.1007/s44163-026-02638-6

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02638-6

Keywords: artificial intelligence, cybersecurity, chatbots, cyber threat detection, machine learning, data mining, bibliometric analysis, phishing detection, intrusion detection, human-centered AI, trust and explainability, business resilience