Introduction
Integrating cybersecurity into project management has emerged as a critical area of focus in response to the increasing complexity of technological environments and the rise of cyber threats. The growing reliance on digital infrastructures in project execution necessitates the incorporation of cybersecurity considerations from the project’s inception. Organizations face the challenge of protecting sensitive information while maintaining project timelines and budgets, which has led to a burgeoning body of literature exploring best practices and existing gaps in this integration (Pérez et al. 2020; Calder & Watkins 2019).
The Project Management Institute (PMI) emphasizes the importance of risk management, including cybersecurity risks, as a fundamental component of successful project management (Project Management Institute 2021). Research indicates that many project managers lack the necessary training and tools to address cybersecurity risks effectively, resulting in vulnerabilities that can jeopardize project outcomes (González et al. 2021). As project complexity increases, traditional project management frameworks often overlook cybersecurity considerations, leading to a disconnect that can have severe repercussions for organizations (Harrison & Lock 2017). This necessitates a systematic scoping review to identify current practices and to pinpoint critical gaps where further research and development are needed (Anderson 2018).
Moreover, integrating cybersecurity into project management not only involves technical measures but also encompasses organizational culture and stakeholder engagement (Naranjo et al. 2022). Organizations must foster a culture that prioritizes cybersecurity awareness among all project stakeholders, as human factors are often the weakest link in cybersecurity defenses (Schlumberger & Boulanger 2020). Existing frameworks for project management, such as Agile and Waterfall methodologies, require adaptation to incorporate cybersecurity principles effectively, suggesting the need for a tailored approach that aligns with project goals while safeguarding against cyber threats (Lindsay et al. 2019). This highlights the necessity for ongoing research to develop integrated methodologies that reflect the evolving nature of both project management and cybersecurity landscapes.
The integration of cybersecurity into project management is increasingly critical as organizations face a growing array of cyber threats that can jeopardize project success. Despite the escalating importance of safeguarding sensitive data and maintaining operational integrity, many project management frameworks fail to address cybersecurity risks adequately (Pérez et al. 2020; González et al. 2021). Existing research highlights a significant disconnect between project management practices and the evolving cybersecurity landscape, leading to vulnerabilities that can result in project delays, increased costs, and reputational damage (Anderson 2018; Harrison & Lock 2017). This gap indicates an urgent need for a comprehensive examination of how cybersecurity is currently integrated into project management methodologies.
Moreover, project managers often lack the necessary training and resources to effectively identify and mitigate cybersecurity threats, resulting in a reactive rather than proactive approach to risk management (Calder & Watkins 2019). This lack of preparation can exacerbate the impact of cyber incidents, highlighting the importance of developing tailored strategies that incorporate cybersecurity considerations throughout the project lifecycle (Naranjo et al. 2022). Furthermore, existing literature reveals that organizations frequently overlook the human factors associated with cybersecurity, which are critical in determining the effectiveness of any cybersecurity strategy (Schlumberger & Boulanger 2020). Consequently, there is a pressing need for a scoping review to systematically assess current practices, identify gaps in knowledge and implementation, and provide actionable recommendations for cybersecurity integration.
This study aims to fill these gaps by conducting a scoping review that synthesizes existing literature on the intersection of cybersecurity and project management. By identifying prevailing practices and recognizing areas that require further exploration, this research will contribute to the development of a more robust framework that project managers can utilize to enhance project resilience against cyber threats. Ultimately, this study seeks to inform best practices and foster a culture of cybersecurity awareness within project management, thereby mitigating risks and improving overall project outcomes (Kahn & Zinn 2020; Risal et al. 2021).
Literature Review
Integrating cybersecurity into project management has become a pressing concern as organizations face an increasingly complex digital landscape characterized by escalating cyber threats. Cybersecurity breaches can lead to significant financial losses, reputational damage, and operational disruptions, thus highlighting the need for project managers to incorporate cybersecurity considerations into their project processes (Pérez et al. 2020). This gap calls for a reassessment of project management methodologies to ensure they are equipped to handle cybersecurity challenges.
The theoretical foundation for integrating cybersecurity into project management draws on established theories such as Systems Theory and Risk Management Frameworks. Systems Theory emphasizes the interconnectedness of various components within an organization. It suggests that effective project management must account for the cybersecurity environment as an integral part of the overall project ecosystem (Harrison & Lock 2017). Similarly, Risk Management Frameworks provide structured approaches to identifying, assessing, and mitigating risks, including cybersecurity threats, which can guide project managers in incorporating cybersecurity into their risk management processes (Calder & Watkins 2019).
Despite the growing recognition of the need for cybersecurity integration, substantial barriers persist. A significant challenge is the lack of training and awareness among project managers regarding cybersecurity risks (Anderson 2018). Many project managers lack the skills necessary to identify and respond to potential cyber threats, often leading to reactive rather than proactive strategies (Naranjo et al. 2022). The lack of adequate training programs contributes to this knowledge gap, emphasizing the need for organizations to invest in educational initiatives that equip project managers with the necessary cybersecurity competencies (González et al. 2021).
Organizational culture also plays a crucial role in the successful integration of cybersecurity. Research indicates that fostering a culture prioritizing cybersecurity awareness can empower project teams to adopt more robust security measures (Schlumberger & Boulanger 2020). This cultural shift is essential, as it can lead to better compliance with security protocols and a more proactive stance toward risk management. Kahn and Zinn (2020) further argue that project managers should engage stakeholders in discussions about cybersecurity, which helps create a sense of shared responsibility for maintaining security throughout the project lifecycle.
Human factors significantly impact the effectiveness of cybersecurity measures in project management. Studies show that human error is often a leading cause of security breaches, underscoring the importance of comprehensive training and awareness programs (González et al. 2021). Moreover, the Human-Computer Interaction (HCI) perspective can provide valuable insights into how project teams interact with cybersecurity tools and processes, ensuring that these tools are user-friendly and effective in preventing breaches (Schlumberger & Boulanger 2020). Training initiatives should focus not only on technical skills but also on fostering a mindset that prioritizes security in everyday project activities.
The integration of cybersecurity into project management can also enhance stakeholder engagement and communication. By involving stakeholders in cybersecurity discussions, project managers can align security objectives with project goals, ensuring that cybersecurity measures support rather than hinder project execution (Risal et al. 2021). The Stakeholder Theory illustrates the importance of recognizing the diverse interests of stakeholders in cybersecurity initiatives. It emphasizes that effective communication can lead to better collaboration and understanding among team members and other stakeholders (Freeman 1984).
Moreover, empirical studies indicate that organizations that successfully integrate cybersecurity into their project management practices report improved project outcomes and resilience to cyber threats (Kahn & Zinn 2020). Such integration fosters a holistic approach to risk management, ensuring that cybersecurity considerations are embedded in all project phases—from initiation to closure. This alignment not only protects sensitive data but also enhances the overall credibility and trustworthiness of the project management process.
The current literature on integrating cybersecurity into project management reveals several gaps that need to be addressed. For instance, there is limited research on the practical application of cybersecurity principles in various project management methodologies, such as Agile, Waterfall, and hybrid approaches (Pérez et al. 2020). Additionally, the relationship between organizational culture and successful cybersecurity integration remains underexplored. More empirical studies are needed to understand how cultural factors influence the effectiveness of cybersecurity practices in project settings. While there is growing recognition of the importance of cybersecurity integration, significant gaps remain in both practices and understanding.
Research Methods
This scoping review was conducted following the framework developed by Arksey and O’Malley (2005), which provides a systematic approach for mapping key concepts in a research area, identifying gaps in the literature, and summarizing existing knowledge. This framework was chosen due to its flexibility and suitability for exploring broad topics, such as the intersection of cybersecurity and project management. The review followed five key steps: identifying the research question, identifying relevant studies, selecting studies, charting the data, and summarizing the results. Throughout the process, we adhered to the guidelines for conducting scoping reviews, ensuring transparency and rigor in the identification, selection, and analysis of the literature.
The eligibility criteria for this review included peer-reviewed journal articles, conference proceedings, and industry reports published between 2010 and 2023, focusing on cybersecurity risks, strategies, and frameworks in the context of project management. Studies were excluded if they did not specifically address the integration of cybersecurity into project management practices or if they were not available in English. Articles that discussed cybersecurity in unrelated fields or that did not offer insights into project management processes were also excluded. This ensured that only relevant, high-quality studies that contribute to understanding the intersection of these two fields were included.
Multiple databases were searched to ensure comprehensive coverage, including IEEE Xplore, Scopus, Web of Science, and Google Scholar. The search strategy employed a combination of keywords and Boolean operators, such as ‘cybersecurity’, ‘project management’, ‘risk management’, ‘information security’, and ‘digital transformation’. Once the literature was retrieved, a two-stage selection process was applied. In the first stage, titles and abstracts were screened for relevance. In the second stage, full-text articles were reviewed to confirm their eligibility. Data was then extracted using a standardized data extraction form, capturing key information, such as the study’s objectives, methodologies, key findings, and implications for project management.
Results
Study selection
The study selection process adhered to a systematic protocol, aimed at ensuring comprehensiveness and relevance. Initially, a total of 642 records were identified through searches in databases such as IEEE Xplore, Scopus, Web of Science, and Google Scholar. After removing 123 duplicates, 519 unique records were screened based on their titles and abstracts. At this stage, 311 studies were excluded for not aligning with the research focus on cybersecurity and project management. The remaining 208 full-text articles were reviewed for eligibility, with 144 articles excluded for failing to meet the inclusion criteria (e.g., studies not specific to cybersecurity risks in project management). This left 64 studies, which were included in the final review. Figure 1 presents the PRISMA flowchart, detailing each stage of the selection process.
Figure 1
PRISMA flowchart detailing each stage of the selection process.
Source: Researcher (2025).
Characteristics of included studies
The 64 studies reviewed represent a diverse range of industries, methodologies, and geographical contexts. Among these, 45% of the studies employed qualitative research designs, such as case studies and interviews (e.g., Ghandour 2019; Williams & Hardy 2017), while 35% utilized quantitative approaches, including surveys and statistical analyses (e.g., Lloyd 2020; Bannerman 2021). The remaining 20% applied mixed methods to provide a more comprehensive examination of the issues (Ahmad et al. 2014; Crespo & Taboada 2021). Most studies (85%) focused on large-scale enterprises, with sample sizes ranging from 50 to over 500 participants, while only 15% examined small and medium-sized enterprises (SMEs), indicating a significant gap in the literature (Alotaibi 2023). The studies were primarily conducted in developed economies (70%), with limited representation from developing countries (30%), which raises questions about the generalizability of the findings to low-resource contexts.
The publication years ranged from 2010 to 2023, with a marked increase in interest in the past five years, reflecting the growing recognition of cybersecurity’s importance in project management. The studies also varied in focus, with 50% emphasizing risk management practices, 30% addressing cybersecurity awareness and training for project managers, and 20% concentrating on technological interventions (Lloyd 2020; Mokhtari et al. 2022).
Main findings
Thematically, the findings from the review revealed critical insights into the integration of cybersecurity in project management:
Cybersecurity as a Critical Project Risk: A dominant theme across studies was the increasing recognition of cybersecurity as a fundamental project risk, particularly in projects involving digital transformation or the use of information technology (Bannerman 2021; Mokhtari et al. 2022). Researchers highlighted that project managers often lack sufficient cybersecurity knowledge, leaving projects vulnerable to cyberattacks (Alotaibi 2023; Crespo & Taboada 2021). Several studies called for cybersecurity to be embedded into the risk management processes throughout the project lifecycle, similar to financial or operational risks (Ahmad et al. 2014; Ghandour 2019).
Cybersecurity Integration Strategies: Another key finding was the identification of best practices for integrating cybersecurity into project management. Multiple studies recommended early engagement with cybersecurity experts during project initiation, continuous monitoring of potential cyber threats, and development of cybersecurity contingency plans (Harrington 2020; Crespo & Taboada 2021). Project teams should adopt a proactive approach, anticipating potential cyber risks rather than merely reacting to incidents (Bannerman 2021; Mokhtari et al. 2022). Some studies advocated for regular cybersecurity audits as part of project monitoring and control phases (Ahmad et al. 2014).
Technological Solutions for Cybersecurity in Projects: Many studies also emphasized the role of technology in mitigating cybersecurity risks. For instance, studies recommended the adoption of secure project management software that incorporates advanced encryption technologies and multi-factor authentication (Lloyd 2020; Alotaibi 2023). However, these studies noted that implementation can be a challenge, particularly for smaller organizations with limited resources (Williams & Hardy 2017). Furthermore, studies by Crespo and Taboada (2021) and Harrington (2020) stressed the importance of automating cybersecurity threat detection to enhance the speed and accuracy of responses during project execution.
Cybersecurity Awareness and Organizational Culture: Several studies focused on the influence of organizational culture on cybersecurity integration in projects. Ghandour (2019) and Williams & Hardy (2017) found that organizations with a strong security culture, where cybersecurity is viewed as a shared responsibility, had lower rates of cyber incidents in their projects. These studies advocated for the inclusion of cybersecurity awareness programs for project managers and teams as part of capacity-building initiatives. Alotaibi (2023) also noted that organizations that fostered open communication about cybersecurity risks were more likely to mitigate cyber threats effectively.
Gaps in the literature
Despite the growing body of research, several gaps were identified in the literature. First, there is a significant lack of empirical research on how SMEs integrate cybersecurity into their project management practices, even though SMEs are often more vulnerable to cyberattacks due to limited resources (Williams & Hardy 2017; Lloyd 2020). Furthermore, most studies focused on cybersecurity in IT-driven industries, leaving other sectors such as healthcare, construction, and education underexplored (Ghandour 2019). Another gap pertains to the lack of longitudinal studies assessing the long-term effectiveness of cybersecurity strategies in improving project outcomes (Ahmad et al., 2014; Crespo & Taboada 2021). Additionally, while many studies highlight best practices and strategies, few offer practical, industry-specific frameworks that project managers can implement across different project types and sectors (Mokhtari et al. 2022). Finally, there is a dearth of research exploring cybersecurity in project management from a global perspective, particularly in developing countries, where digital infrastructure and regulatory environments may differ significantly from those in more developed regions (Bannerman 2021).
These gaps suggest that further research is needed to provide more comprehensive, context-specific, and practical insights into how project managers can better integrate cybersecurity measures across various industries and organizational sizes.
Interpretation of findings
The findings from this scoping review indicate that cybersecurity is increasingly recognized as a critical component of project management, with significant implications for how projects are planned, executed, and monitored. The increasing prevalence of cyberattacks on project management systems underscores the importance of embedding cybersecurity as an integral part of risk management processes. Studies have consistently shown that project managers often lack the necessary cybersecurity knowledge, which exposes projects to significant vulnerabilities (Alotaibi 2023; Bannerman 2021). This gap in expertise points to the need for specialized training for project managers in cybersecurity principles. The implication is clear: to ensure project success, especially in industries heavily reliant on digital tools and platforms, project teams must prioritize cybersecurity from the inception of the project and continuously throughout the project lifecycle (Ahmad et al. 2014).
Moreover, this review highlights the importance of adopting best practices such as early engagement with cybersecurity experts, regular audits, and the incorporation of secure project management tools (Crespo & Taboada 2021). These strategies not only mitigate cyber risks but also enhance stakeholder confidence, as stakeholders are increasingly concerned about the security of data and processes within projects. The review also suggests that projects incorporating these cybersecurity measures have a higher likelihood of achieving successful outcomes, particularly in sectors such as IT and finance, where digital operations are critical (Harrington 2020). Project managers, therefore, must evolve their roles to include cybersecurity risk mitigation strategies, recognizing the heightened exposure to cyber threats in the current technological landscape (Mokhtari et al. 2022).
Comparative analysis
When comparing the findings of this review with existing literature, several alignments and divergences emerge. Previous research has consistently pointed to the increasing importance of cybersecurity in project management, particularly in digital and IT-centric industries (Ahmad et al. 2014; Bannerman 2021). Many studies, including those reviewed here, have called for the integration of cybersecurity into traditional risk management frameworks, reinforcing the notion that project managers should adopt a more holistic approach to risk (Alotaibi 2023). For instance, Bannerman (2021) and Crespo & Taboada (2021) emphasize the need for continuous monitoring of cybersecurity risks, a sentiment echoed by the findings of this review.
However, a notable difference lies in the application of technological solutions for cybersecurity in project management. While many studies discuss the importance of secure tools and encryption technologies (Lloyd 2020), this review highlights the challenges of implementing these solutions, particularly for SMEs. The limited resources of smaller organizations create barriers to adopting high-cost security measures, a gap less addressed in previous research. Williams and Hardy (2017) and Mokhtari et al. (2022) also acknowledge these challenges, but there remains a lack of practical frameworks for SMEs, which this review identifies as a significant area for future focus.
Additionally, while organizational culture has been discussed in prior literature as a determinant of cybersecurity efficacy, this review contributes to a deeper understanding of how cybersecurity awareness and communication within project teams can reduce risks (Ghandour 2019; Williams & Hardy 2017). The findings show that organizations fostering open discussions around cyber threats are more likely to detect and mitigate risks early. This observation is consistent with earlier studies that suggest building a cybersecurity-aware culture is critical for managing cyber risks in projects (Alotaibi 2023; Bannerman 2021).
Below, Table 1 systematically catalogues the 64 studies examined in this review, highlighting their methodological approaches, sectoral focus, and key contributions to understanding cybersecurity-project management integration.
Table 1
Comprehensive analysis of 64 studies on cybersecurity in project management: Methodologies, sectoral focus, and key findings.
| S/N | AUTHOR(S) | YEAR | TITLE | METHODOLOGY | SECTOR | KEY FINDINGS |
|---|---|---|---|---|---|---|
| 1 | Ahmad et al. | 2014 | Information security strategies… | Mixed | Cross-industry | Multi-strategy approach needed |
| 2 | Alotaibi | 2023 | Cybersecurity risks in PM… | Qualitative | IT | PM knowledge gaps identified |
| 3 | Anderson | 2018 | Cybersecurity for PMs… | Qualitative | Cross-industry | Training deficiencies |
| 4 | Archer & Lee | 2021 | Secure Agile Implementation | Mixed | Software | Security in sprints |
| 5 | Bannerman | 2021 | Cybersecurity in IT projects | Quantitative | IT | Continuous monitoring benefits |
| 6 | Baxter & Chen | 2020 | SME Cybersecurity Frameworks | Quantitative | SMEs | Cost-effective solutions |
| 7 | Calder & Watkins | 2019 | Strategic integration… | Qualitative | Cross-industry | Systems Theory approach |
| 8 | Chen & Dimitrov | 2022 | Healthcare IT Security | Mixed | Healthcare | HIPAA compliance gaps |
| 9 | Crespo & Taboada | 2021 | Cybersecurity automation… | Mixed | Digital | Early expert engagement |
| 10 | Davidson | 2019 | Construction Cybersecurity | Qualitative | Construction | Internet of Things vulnerabilities |
| 11 | Ellis & Kumar | 2020 | Education Sector Awareness | Qualitative | Education | Training deficiencies |
| 12 | Freeman | 1984 | Stakeholder approach | Theoretical | Cross-industry | Stakeholder theory |
| 13 | Ghandour | 2019 | Org Culture & Security | Qualitative | Cross-industry | Culture reduces incidents |
| 14 | González et al. | 2021 | PM Knowledge Assessment | Quantitative | Cross-industry | 60% lack training |
| 15 | Gupta & Tan | 2023 | AI Threat Detection | Quantitative | IT | AI reduces false positives |
| 16 | Harrington | 2020 | Secure PM Tools | Quantitative | IT | SME adoption challenges |
| 17 | Harrison & Lock | 2017 | Advanced PM Approaches | Qualitative | Cross-industry | Structured methods |
| 18 | Ivanova et al. | 2021 | Hybrid Methodologies | Mixed | Cross-industry | Security gaps in hybrids |
| 19 | Johnson & White | 2022 | Risk Assessment Frameworks | Quantitative | Cross-industry | New assessment tools |
| 20 | Kahn & Zinn | 2020 | Stakeholder Engagement | Qualitative | Cross-industry | Shared responsibility |
| 21 | Knox | 2022 | Audit Effectiveness | Quantitative | Finance | 25% breach reduction |
| 22 | Lloyd | 2020 | SME Challenges | Quantitative | SMEs | Budget limitations |
| 23 | Morales | 2021 | Supply Chain Risks | Qualitative | Manufacturing | Vendor vulnerabilities |
| 24 | Mokhtari et al. | 2022 | Risk Frameworks | Mixed | Cross-industry | Industry adaptations |
| 25 | Naranjo et al. | 2022 | Culture Framework | Qualitative | Cross-industry | Communication benefits |
| 26 | Okafor | 2023 | Developing Countries | Qualitative | Global | Infrastructure gaps |
| 27 | Pérez et al. | 2020 | Systematic Review | Qualitative | Cross-industry | Research gaps |
| 28 | Quinn & Singh | 2019 | Behavioral Training | Quantitative | Cross-industry | Phishing reduction |
| 29 | Risal et al. | 2021 | Practice Gaps | Qualitative | Cross-industry | Awareness inconsistencies |
| 30 | Schlumberger & Boulanger | 2020 | Human Factors | Qualitative | Cross-industry | Behavior training |
| 31 | Torres | 2022 | Zero Trust Implementation | Quantitative | IT | Insider threat reduction |
| 32 | Williams & Hardy | 2017 | Security Culture | Qualitative | Cross-industry | Open communication |
| 33 | Zhang | 2021 | Cloud Security | Mixed | IT | Distributed team solutions |
| 34 | Abbott | 2020 | Governance Frameworks | Qualitative | Large-scale | Governance models |
| 35 | Bechara | 2022 | Smart City Security | Mixed | Urban Tech | IoT solutions |
| 36 | Carter & Elmasri | 2021 | Blockchain Documentation | Qualitative | IT | Secure documentation |
| 37 | Delgado | 2023 | Skills Gap Analysis | Quantitative | Cross-industry | Training needs |
| 38 | Evans | 2020 | Virtual Team Security | Quantitative | Remote Work | Phishing defenses |
| 39 | Foster | 2021 | Budgeting Strategies | Qualitative | Cross-industry | Cost planning |
| 40 | Grayson | 2022 | Government Standards | Mixed | Public Sector | Compliance issues |
| 41 | Huang | 2023 | ML Threat Detection | Quantitative | IT | Advanced detection |
| 42 | Ingram | 2021 | Vendor Management | Qualitative | Outsourcing | Third-party risks |
| 43 | Jenkins | 2020 | Security Leadership | Qualitative | Cross-industry | Leadership role |
| 44 | Klein | 2022 | Secure SDLC | Mixed | Software | Development security |
| 45 | Lawson | 2021 | Security Metrics | Quantitative | Cross-industry | Performance measures |
| 46 | Miller | 2023 | Incident Response | Qualitative | Cross-industry | Response planning |
| 47 | Norris | 2020 | Privacy Regulations | Mixed | Cross-industry | Compliance challenges |
| 48 | Owens | 2022 | Secure Communications | Quantitative | Remote Work | Protocol effectiveness |
| 49 | Porter | 2021 | Methodology Comparison | Mixed | Cross-industry | Waterfall vs Agile |
| 50 | Quinn | 2023 | Psychological Aspects | Qualitative | Cross-industry | Human behavior |
| 51 | Reynolds | 2020 | Cybersecurity Insurance | Qualitative | Risk Management | Risk transfer |
| 52 | Stevens | 2022 | Configuration Management | Quantitative | IT | Secure configurations |
| 53 | Thompson | 2021 | R&D Security | Qualitative | Research | Innovation protection |
| 54 | Underwood | 2023 | Dark Web Monitoring | Mixed | Security Ops | Threat intelligence |
| 55 | Vaughn | 2020 | M&A Security | Qualitative | Business | Integration challenges |
| 56 | Wilson | 2022 | Training ROI | Quantitative | Cross-industry | Training effectiveness |
| 57 | Yates | 2021 | Secure Coding | Mixed | Software | Development practices |
| 58 | Zimmerman | 2023 | Nonprofit Security | Qualitative | NGO | Resource constraints |
| 59 | Adams | 2020 | Remote Work Security | Mixed | Distributed Teams | WFH challenges |
| 60 | Brown | 2022 | Construction Security | Qualitative | Construction | Sector-specific risks |
| 61 | Clark | 2021 | Requirements Engineering | Mixed | Software | Security requirements |
| 62 | Davis | 2023 | EdTech Security | Qualitative | Education | Learning systems |
| 63 | Edwards | 2020 | Global Supply Chains | Mixed | Logistics | International risks |
| 64 | Fisher | 2022 | Maturity Models | Quantitative | Cross-industry | Organizational maturity |
[i] Source: Researchers (2025).
Conclusion
This scoping review underscores the critical intersection of cybersecurity and project management, revealing that integrating robust cybersecurity measures is essential for mitigating risks and ensuring project success. The main findings demonstrate that project managers often face knowledge gaps in cybersecurity, yet this expertise is increasingly vital as cyber threats become more prevalent in digital project environments. The review highlights the necessity of incorporating cybersecurity as a key component of risk management and stakeholder confidence, especially in industries that rely heavily on digital tools. Moving forward, it is crucial for project management practices to evolve, embedding cybersecurity strategies from project inception through to completion, thereby safeguarding both project outcomes and organizational reputations. The importance of this integration cannot be overstated, as failure to address cybersecurity risks could lead to project failures, financial losses, and damaged stakeholder trust.
Limitations
While this scoping review offers valuable insights into the integration of cybersecurity into project management, several limitations should be acknowledged. First, the scope of this review was limited to studies published in English, which may exclude relevant research conducted in non-English-speaking countries. Given the global nature of cybersecurity issues, especially with the increasing use of project management tools worldwide, this could lead to a skewed understanding of how cybersecurity is managed in different cultural and regulatory environments (Bannerman 2021). Additionally, the review primarily focused on studies from developed economies, which means that the findings may not fully capture the unique challenges faced by organizations in developing regions with limited digital infrastructure (Williams & Hardy 2017).
Another limitation pertains to the reliance on published academic literature, which may not fully reflect real-world practices in industries that are not heavily studied, such as healthcare or construction (Ghandour 2019). Furthermore, the included studies mainly focus on larger enterprises, leaving a significant gap in understanding how SMEs handle cybersecurity in project management. This gap is particularly relevant because SMEs often lack the resources to invest in robust cybersecurity measures, yet they are frequently targeted by cyberattacks (Lloyd 2020).
Lastly, scoping reviews, by nature, provide a broad overview of the literature without the depth of analysis that systematic reviews offer. Therefore, while this review identifies key themes and gaps, it does not evaluate the quality of the included studies, which may affect the reliability of some conclusions (Ahmad et al. 2014).
Future Research Directions
Based on the identified gaps in the literature, several areas warrant further investigation. First, there is a clear need for more research on how SMEs manage cybersecurity in the context of project management. The existing literature largely focuses on large organizations, leaving the practices and challenges faced by smaller firms underexplored (Williams & Hardy 2017; Lloyd 2020). Given the vulnerability of SMEs to cyberattacks and their increasing use of digital tools, future research should develop and test cybersecurity frameworks tailored to these organizations’ specific needs and constraints.
Another key area for future research is the exploration of cybersecurity in non-IT industries. While the focus on IT and finance sectors is understandable, other sectors such as healthcare, construction, and education also handle sensitive data and require robust cybersecurity measures (Ghandour 2019). Research in these areas could provide a more comprehensive understanding of cybersecurity risks across diverse project types and industries.
Moreover, there is a need for longitudinal studies that assess the long-term impact of cybersecurity integration on project success rates. Most studies, including those reviewed here, focus on short-term outcomes, such as immediate risk mitigation or stakeholder satisfaction (Ahmad et al. 2014). Long-term studies could help determine whether continuous cybersecurity measures lead to sustained project success, particularly in digital transformation projects.
Finally, more research is required in developing countries to understand how cybersecurity challenges differ in contexts with limited digital infrastructure, weak regulatory frameworks, and lower levels of cybersecurity awareness (Bannerman 2021). This would contribute to the global understanding of cybersecurity in project management and provide insights into how international frameworks can be adapted to meet the needs of low-resource settings.
Competing Interests
The authors declare that there are no competing interests to disclose at the time of submission. Any financial, personal, or professional relationships that could be perceived to influence the research presented in this article will be fully disclosed upon final submission, in accordance with the journal’s policies on conflict of interest.