Cybersecurity chatbots work best as assistants, not replacements, study finds - Bioengineer.org

Cyber threats are becoming increasingly automated and adaptive, with a new study arguing that defending against them cannot rely on algorithms alone. Researchers Tianming Lu and Zongwen examined how AI is used in cyber threat detection and found that chatbot-supported cybersecurity is valuable as a first-level assistant but should not replace validated detection technologies or human security professionals.

Research methodology

The study employed a sequential mixed-method design. First, researchers conducted a bibliometric review of 2,015 publications from Scopus and Web of Science between January 2016 and April 2026. They analyzed publication trends, authors, countries, journals, and keyword clusters using VOSviewer. Second, they conducted semi-structured interviews with 20 participants—10 developers and 10 users of AI chatbot systems.

The bibliometric analysis revealed three major thematic clusters: cybersecurity applications, AI detection methods, and data-mining-based network intrusion detection. India led with 968 publications (42.33% among top 15 countries), while the United States ranked second with 409 documents and 3,119 citations. Australia achieved the highest citation impact at 58.69 citations per document despite only 52 publications.

Chatbot capabilities

Interview findings showed cybersecurity chatbots can provide rapid warnings about suspicious logins, unsafe links, and unusual account activity; explain why something was classified as suspicious; support phishing identification; offer first-level incident-response guidance; improve cybersecurity awareness; and escalate serious cases to human specialists.

Critical concerns

Researchers identified substantial challenges. Developers stressed that data quality is crucial for reliable detection, as poor-quality data and outdated attack patterns reduce effectiveness. False positives and false negatives remain central issues—repeated false warnings cause alert fatigue, while missed attacks create false security. Users did not automatically trust chatbot advice, with trust depending on accuracy, clarity, privacy protection, and prior experience.

Privacy concerns were strong, with users hesitant to share account details or security information. Adversarial risks, including prompt manipulation, and the danger of overreliance on automated advice were also highlighted.

Proposed framework

Based on findings, researchers propose a human-centered framework with six dimensions: data foundation, detection intelligence, chatbot interaction, developer responsibility, user acceptance, and governance. This framework aligns with NIST AI Risk Management principles, emphasizing trustworthy AI that is valid, reliable, secure, transparent, explainable, privacy-enhanced, and fair.

The authors acknowledge limitations, including English-language restrictions in their dataset and the exploratory nature of their qualitative sample. They suggest future research could use large-scale surveys and experiments to test different chatbot warning designs. The study's message remains clear: effective AI-driven cybersecurity requires both technical reliability and human-centered design.