Cybersecurity resilience in logistics enterprises: an empirical socio-technical analysis

Purpose: This study examines cybersecurity resilience in Polish logistics enterprises by analysing how threat exposure influences cybersecurity policy, how cybersecurity policy affects organisational cybersecurity performance, and how organisational cybersecurity performance contributes to supply chain trust. The study adopts a socio-technical perspective in which cybersecurity policy integrates access-control practices, technological safeguards, procedural measures, and preventive actions. Design/methodology/approach: Data were collected through a questionnaire survey distributed to 160 logistics enterprises operating in Poland. A total of 130 complete and usable responses were obtained and used as the final analytical sample. The data were collected via the Computer-Assisted Web Interviewing method and analysed using Partial Least Squares Structural Equation Modelling (PLS-SEM) to test a serial socio-technical model linking threat exposure, cybersecurity policy, organisational cybersecurity performance, and supply chain trust. Findings: The results show that threat exposure positively affects cybersecurity policy adoption in logistics enterprises. Cybersecurity policy, modelled as a multidimensional higher-order construct comprising access-control practices, technological safeguards, procedural measures, and preventive actions, positively affects organisational cybersecurity performance. Organisational cybersecurity performance, in turn, positively influences supply chain trust. The findings therefore support the proposed serial relationship between the four constructs. Originality/value: This study addresses the limited empirical research on cybersecurity resilience in logistics enterprises, particularly in the Central and Eastern European context. It develops and tests a coherent socio-technical framework explaining how perceived threat exposure translates into cybersecurity policy, organisational cybersecurity performance, and supply chain trust. The study contributes by modelling cybersecurity policy as an integrated higher-order construct rather than as a collection of unrelated technical and organisational practices.