Optimising Hybrid-Threat Response Processes through Intrusion Detection Systems: An Integrative Framework Linking Strategic Leadership and Operational Efficiency in National Security Institutions

Moromenacho E.G.P.; Véliz M.J.R.; Robles F.G.T.; Morales-Fernández B. · Journal of Intelligent Decision Making and Information Science (2026) · DOI: 10.59543/jidmis.v3.2138

Resumen

Hybrid threats combine cyber intrusions, disinformation, critical-infrastructure sabotage and economic coercion below the threshold of declared war, compressing the time available for national-security institutions to detect and respond. Intrusion detection systems (IDS) have matured into a technically capable detection backbone, with machine-and deep-learning classifiers now reporting detection accuracies frequently above 95%. Yet detection performance alone does not determine response performance: the translation of an alert into a timely, coordinated and legitimate institutional response is shaped by strategic leadership and by the operational efficiency of the response process. The technical IDS literature and the strategic-leadership and public-administration literatures have largely developed in isolation, leaving the mechanism that connects detection capability to response optimisation under-theorised. This paper addresses that gap through an integrative review of 41 peer-reviewed studies and a conceptual-framework development. It proposes a moderated-mediation model in which IDS detection capability influences hybrid-threat response optimisation directly and indirectly through operational efficiency, with strategic leadership acting as a moderator that governs how detection capability is converted into organisational advantage. The framework is operationalised through a set of constructs, indicators and metrics — including mean time to detect (MTTD) and mean time to respond (MTTR) — and a proposed mixed-methods validation design, together with a five-tier capability-maturity profile for institutional benchmarking. The study contributes an interdisciplinary bridge between cybersecurity engineering and security-sector leadership research, and offers policymakers and security-institution leaders a structured basis for investment and evaluation decisions. The framework is conceptual and its propositions await empirical testing.

Instituciones: Universidad San Ignacio de Loyola; Universidad de Lima