Cyber-attackers as a social force: conceptualizing value sabotage in cybersecurity services Open Access

Purpose
This paper examines the role of cyber-attackers as a critical social force within the cybersecurity service ecosystem. We propose a conceptual framework that integrates attackers into the traditional service triad, reframing them as attackers who influence value co-creation and service dynamics within the cybersecurity industry, particularly in the context of Cybersecurity-as-a-Service (CSaaS). We conclude that cyber-attackers represent agents of “value sabotage,” a novel concept that captures how threat actors reshape service dynamics.

Design/methodology/approach
The study draws on a review of service management and cybersecurity literature, complemented by case studies of notable cyber-attacks. Building on service-dominant logic and ecosystem theory, a conceptual framework is developed, positioning attackers as influential disruptors within the CSaaS ecosystem.

Findings
The findings reveal attackers as adversarial social forces driving innovation and adaptation in the CSaaS ecosystem. An analysis of their motivations and strategies reveals how their actions compel organizations and service providers to prioritize resilience and defensive value co-creation. In turn, attackers' actions “sabotage” the value co-creation process. Our proposed framework demonstrates a transition from dyadic to triadic service interactions, incorporating attackers as critical agents.

Research limitations/implications
Future research could explore the generalizability of this framework across other industries and more specific comparisons between value sabotage and value co-destruction. Additional social forces could also be considered, such as regulators and end-customers (pentadic model).

Practical implications
The findings underscore the need for organizations to adopt adaptive service strategies that prioritize resilience, threat anticipation and collaboration to counter cyber-attacks.

Originality/value
This paper uniquely positions attackers as active contributors to the service ecosystem, extending service theory and challenging conventional notions of value co-creation in service management through the novel concept of “value sabotage.” Framing attackers as malicious orchestrators of disruption, our work offers a new lens to understand how threat actors shape service design, resilience and co-creation strategies in digitally mediated service environments.