The escalating digital interconnectivity of Critical Infrastructure (CI) necessitates robust cybersecurity solutions, particularly for effective incident detection and response. This systematic literature review explores the promising role of Digital Twins (DTs) in enhancing these critical functions across diverse CI sectors, including smart cities, healthcare, and energy. Covering research from 2019 onwards, we conduct an in-depth analysis of 27 curated articles, examining attacks, detection methods, response techniques, and emerging trends specifically related to incident handling within this domain. Our review reveals DTs as a powerful tool for CI cybersecurity, enabling proactive threat simulation and improved incident management capabilities. However, challenges persist, including scalability, interoperability with legacy systems, and the need for rigorous real-world validation of incident response effectiveness. Furthermore, we identify common shortcomings in existing research, such as algorithmic flaws, inadequate validation, poor metric reporting, and insufficient threat modeling, all of which impact incident-handling capabilities. Despite these limitations, our systematic analysis underscores that DTs can significantly bolster CI security for incident detection and response when these challenges are addressed. To our knowledge, this work provides the first full-fledged survey uniquely and specifically focused on DT-enabled cybersecurity incident detection and response within CI contexts, addressing a critical gap not comprehensively covered by prior reviews and serving as a foundational resource for stakeholders.

Digital Twins (DTs) are increasingly recognized as a strategic technology for enhancing cybersecurity in industrial environments, particularly in the face of rising threats targeting Operational Technology (OT). After comparatively examining closely related DT–cybersecurity frameworks to position the contribution within the existing research landscape, this paper presents a systematic literature review and comparative analysis of 19 recent DT-based cybersecurity studies, focusing on their relevance to incident detection and response in sectors such as Industrial Internet of Things (IIoT), manufacturing, and energy. The analysis evaluates each study across multiple dimensions, including attack types, detection and response mechanisms, DT integration, and technology stacks. From this review, we derive a consolidated set of requirements, categorized as functional, non-functional, security-specific, and domain-specific. These requirements serve as the foundation for a novel, cybersecurity-focused, ISO 23247-based framework. The proposed architecture formalizes a DT-enabled incident detection and response lifecycle aligned with ISO 23247. It is explicitly mapped to the derived requirements and detailed with practical implementation considerations. This work contributes a structured, evidence-based approach to DT-based security engineering and offers a reference design for researchers and practitioners aiming to build resilient, adaptive cybersecurity solutions in industrial settings.

Modern Endpoint Detection and Response (EDR) platforms, such as Microsoft Defender for Endpoint (MDE), provide sophisticated telemetry but often leave Security Operations Centers (SOCs) struggling with a significant detection lag, namely the time required to manually translate emerging threat intelligence into operational logic. This paper presents a systematic empirical study of an LLM-integrated pipeline designed to automate the transformation of structured threat intelligence from OpenCTI into functional Kusto Query Language (KQL) detection rules. By utilizing Large Language Models (LLMs) as a contextual translation layer, we evaluate a framework that maps graph-based STIX metadata directly to proprietary EDR schemas. Our experiments, conducted within a high-fidelity Windows Server 2025 environment, reveal that LLM-augmented rules successfully addressed critical visibility gaps in reconnaissance and early-stage lateral movement where native MDE heuristics remained silent. Importantly, the implementation reduced the intelligence-to-logic latency from an average of 45 min of manual engineering to sub-5-min automated cycles. While the findings identify persistent challenges regarding schema hallucinations, the study concludes that LLM-assisted detection engineering serves as a significant operational force multiplier, enabling defensive postures to evolve at the velocity of the modern threat landscape.

Smart-environment cybersecurity increasingly depends on experimental platforms that can reproduce attacks against buildings, homes, and cities under realistic conditions. However, the literature remains fragmented across testbed design, attack demonstration, and defensive validation. This makes it particularly difficult to judge what kind of security evidence each study actually provides. This review systematically analyzes 28 experimentally grounded studies published from 2020 onwards, focusing on how testbed realism, cyber-physical coupling, and evaluation mode shape the strength of the resulting claims. The corpus spans physical, hybrid, emulated, and dataset-driven environments across smart buildings, smart homes, and smart cities. Through our investigation, we discern a clear asymmetry in the field. Detection-oriented studies dominate, especially those based on emulation or public datasets, while live evidence for prevention, response, containment, and recovery is comparatively scarce. Availability and integrity/control attacks are the most frequently exercised, whereas authentication compromise and software exploitation remain rare because they are harder to stage on real hardware. Moreover, an important observation we arrive at is that physical and hardware-in-the-loop platforms support the strongest cyber-physical evidence, but emulated and replayed environments remain valuable for scale and reproducibility. At the same time, public datasets and offline classification results do not by themselves establish operational resilience in a live smart environment. To make these distinctions explicit, we introduce a cross-domain taxonomy of testbed architectures, attack families, and defensive control coverage, and map the evidence strength of reported mitigations using NIST cybersecurity framework-derived operational functions. Last, we identify open challenges, including weak recovery evaluation, limited reuse of reference testbeds, and the need for live, context-aware datasets, outlining promising future directions.