Business Analytics Capability and Organizational Cyber Resilience: The Roles of Data-Driven Risk Detection and Cybersecurity Governance

This study examines the relationships among business analytics capability, data driven risk detection, and organizational cyber resilience while evaluating the moderating influence of cybersecurity governance maturity. Drawing on Dynamic Capabilities Theory and Organizational Information Processing Theory, it conceptualizes organizational cyber resilience as the outcome of organizational capabilities that transform integrated analytical resources and cyber risk information into timely, coordinated, and adaptive responses. Cybersecurity governance maturity serves as a boundary condition that determines whether analytical insights can be translated into stronger resilience outcomes. A quantitative cross-sectional design gathered responses through a five point Likert scale questionnaire from 385 Vietnamese professionals knowledgeable about business analytics, cybersecurity, information technology, risk management, digital operations, organizational governance, or business continuity. IBM SPSS version 26 supported reliability assessment, exploratory factor analysis, and multiple linear regression, while Hayes’ Process Macro Model 1 examined the moderating effect. The findings show that business analytics capability (β = 0.573) and data driven risk detection (β = 0.638) significantly improve organizational cyber resilience. Data driven risk detection produces the stronger direct effect, emphasizing the importance of continuous monitoring, anomaly identification, and actionable cyber risk warnings. Cybersecurity governance maturity further strengthens the positive relationship between business analytics capability and organizational cyber resilience through a significant interaction coefficient of 0.407. The results demonstrate that analytical technologies alone cannot guarantee cyber resilience. Organizations must combine integrated analytical resources and timely risk detection with clear accountability, formal escalation procedures, structured oversight, continuous governance improvement, and sufficient authority to coordinate responses.