Business & Technology
Glasgow study flags digital twin cyber risks in firms
University of Glasgow researchers have warned that cybersecurity research on digital twins is overlooking organisational risks. The study was carried out within the TransiT transport decarbonisation research hub.
Academic work has focused heavily on technical questions such as detecting attacks, securing data sharing and making systems interoperable, while paying much less attention to how organisations and staff manage cyber risk in practice.
Digital twins are digital replicas of physical assets or systems. They are used in sectors including transport, construction, manufacturing and healthcare. In transport, they are increasingly seen as tools for testing changes to complex networks without relying solely on real-world trials.
The Glasgow team reviewed more than 1,800 academic papers on cybersecurity, digital twins and organisational barriers to adoption, then narrowed the pool to 41 studies that included social or organisational perspectives, including participant-based research.
The analysis identified a series of underexplored issues beyond software and infrastructure. These included competing priorities between cybersecurity teams and operational staff, employee resistance to security policies when they interfere with core work, financial pressures, limited organisational commitment, skills shortages and worker concern about possible job losses linked to digitalisation.
It also highlighted governance problems that can grow when digital twin systems involve multiple organisations. Shared responsibility across IT teams, operational technology specialists, data teams and external suppliers can make accountability harder to define, particularly as systems expand and become more interconnected.
Dr Stefanos Evripidou, a cybersecurity researcher at the University of Glasgow and lead author of the study, said the gap matters because digital twins are moving beyond isolated deployments.
“Cybersecurity is both a social and a technical challenge, because it involves people and organisational processes, as well as technology. These dimensions are inherently interdependent, so we need to understand the technical and the organisational challenges together rather than in isolation. But our research has found that very little is known about the kind of real-world cybersecurity issues that organisations face around the implementation of digital twins. It’s critical that we bridge this gap in knowledge, because digital twins are being scaled and connected to address increasingly complex challenges that span whole sectors or societies. This means we’re also hugely expanding the attack surface and increasing exposure to cybersecurity threats,” Dr Evripidou said.
The study, published in the journal Computers & Security, argues that most research focused on cybersecurity remains strongly technical, even though day-to-day security outcomes inside organisations often depend on management structures, workplace culture and staff behaviour.
Workplace friction
Among the specific concerns identified is what the researchers describe as security fatigue. This can emerge when staff see cyber rules as adding to their workload or slowing their main responsibilities, making them more likely to adopt informal workarounds or leave security concerns out of operational decisions.
The paper states: “Security often conflicts with other business practices, particularly when it adds additional workload, creating friction between security and productivity. This can result in security fatigue, where employees may adopt less demanding workarounds and more broadly, lead to security’s exclusion from the decision-making process.”
The findings are likely to draw attention in transport and energy, where policymakers and industry have shown growing interest in linked digital twin environments spanning assets, companies and public infrastructure. The authors argue that current standards do not properly address the risks specific to those arrangements.
To address the gap, the paper sets out several research priorities. These include more interviews, case studies and ethnographic work on live digital twin projects, closer examination of how responsibilities are divided among stakeholders, and the development of governance and regulatory frameworks suited to connected digital twin systems.
The researchers also propose what they call a sensemaking framework to help organisations assess cyber needs according to a twin’s purpose, how closely it is integrated with the physical world and how critical the underlying system is.
TransiT, the research hub behind the work, focuses on using digital twins to identify lower-risk, lower-cost routes to cutting emissions in UK transport across road, rail, air and maritime networks for passengers and freight. The collaboration brings together eight universities and almost 70 industry partners, and is jointly led by Heriot-Watt University and the University of Glasgow.
The study involved co-authors Xicheng Li, Dr Mohammad Al-Quraan, Dr Runze Cheng, Dr Ahmad Taha, Professor Muhammad Imran, Professor David Flynn and Professor Dimitrios Pezaros, all based at the University of Glasgow through TransiT.
One of the clearest weaknesses in the current literature, the authors argue, is the limited understanding of how digital twin stakeholders themselves view cyber risk.
“A key gap identified in our analysis is the limited research into how digital twin stakeholders understand cybersecurity and its associated risks in digital twins,” the researchers wrote.
Gas network company SGN confirmed it had repaired three minor gas leaks and left the site on Monday, August 3, six days earlier than expected.
The leaks were discovered during excavation works last month and contributed to the pushing back of the road’s reopening date, yet again, to September 20.
The completion of the gas mains replacement marked a significant step forward in the wider Oxford Station improvement project, which was originally budgeted at £161 million but is now expected to cost at least £237 million.
The development prompted hopes that Botley Road, closed beneath the rail bridge since April 2023, could reopen earlier than planned.
However, Network Rail has moved to manage expectations, saying the project remains on course to meet its existing target date rather than finish ahead of schedule.
A Network Rail spokesperson said: “We’re pleased that SGN has completed its gas mains replacement work.
“While this is an important milestone, it doesn’t necessarily mean the overall project will finish early as some remaining work is dependent on access to the railway, which we have had to rearrange to enable the replacement of the gas main.
“Our focus remains on meeting our planned deadline of 20 September for reopening Botley Road to traffic.”
While the completion of the gas works removes one of the most recent obstacles facing the scheme, Network Rail says further work under the bridge and around the station is still needed before the route can reopen to traffic.
The club is currently struggling in the summer heat, and has launched a new fundraiser to keep its gymnasts safe.
The club, which is based at Grove House Barn near Warkworth in Banbury, launched the fundraiser so it could buy and install four air conditioning units to keep its space cool.
Currently, the club hopes to raise £7,000 through the appeal so it can buy four 10kW air conditioning units and cover all the installation costs.
So far, the club has raised £380.
Karl Wade, director of Wade Gymnastics, said the club has become “increasingly warm” during the summer months due to the rising temperatures.
READ MORE: Thames Water leakage targets are ‘not realistic’ says boss after pay rise
“Despite our best efforts to keep doorways and shutters open, it becomes very uncomfortable for gymnasts to play and train,” Mr Wade said.
He added: “The safety of our gymnasts and coaches is always our utmost priority.
“Unfortunately, the risk of having to close the business during these hot spells is increasing and we need to have more effective ways of keeping everyone cool.
“An air conditioning system would allow the business to stay open during those extreme hot conditions and continue to provide classes for everyone who attends.”
The gym currently delivers classes seven days a week for around 900 people, which range from toddlers to athletes competing at national level.
The gym club was founded more than four decades ago by Ruth Wade and, for the past 20 years it has been based at its current facility.
SOFIAH NICHOLE SALIVIO
News Editor
Solihull Council has appointed ICS.AI to deliver the first phase of an AI Transformation Discovery programme to examine how artificial intelligence could be used across several resident-facing services.
The 24-week programme will review opportunities in Adult Social Care, Children’s Services, Economy & Infrastructure, and Public Health. It is intended to help the council decide where AI could be used and where future spending should be directed.
In this first phase, ICS.AI will assess the council’s readiness for AI and identify use cases across the four service areas. The programme is expected to produce a prioritised shortlist of about 200 use cases, including 50 validated from a finance perspective, alongside a longer-term AI Transformation Roadmap.
The work is intended to create an evidence base before any wider implementation decisions are taken. Ethics, privacy, and safeguarding will be considered throughout the assessment process.
Discovery phase
ICS.AI will use its AI Target Operating Model framework to review Solihull’s current position across five dimensions before ranking opportunities. The outputs will be based on council-owned baseline data and reviewed by public sector specialists.
The approach reflects a broader pattern among local authorities exploring AI in service delivery while facing pressure to justify spending and manage risks around data use and public accountability. Councils have also been seeking clearer business cases before committing to larger technology programmes.
Solihull said the discovery exercise would support a measured approach to service modernisation. The authority wants to identify where AI could improve services for residents while also demonstrating value for money.
“We are committed to taking a well-considered and planned approach to modernising the services we provide. By building a strong evidence base for future decisions, this programme will help us understand where the greatest AI opportunities exist. We will then be able to prioritise those improvements that will deliver the greatest benefit for residents, while ensuring full value for the council,” said Councillor Dave Pinwell, Cabinet Portfolio Holder for Resources, Solihull Council.
Public sector focus
ICS.AI said the Solihull engagement builds on work it has carried out with more than 20 public sector organisations using its AI transformation and discovery assessments. Those organisations include Derby City Council.
The company focuses on AI projects for the public sector, where interest has increased as authorities look for ways to manage demand pressures in social care, public health, and other frontline services. At the same time, councils are under scrutiny to show that new technology investments are proportionate and supported by practical evidence.
Dwayne Johnson, Chief Local Government Officer at ICS.AI, said local authorities need stronger justification before committing funds. “Local authorities need confidence that every investment is backed by robust evidence and long-term value for residents. Solihull Council is taking the right approach by starting with a structured discovery programme that builds a clear understanding of priorities before decisions are made. By developing finance-validated business cases and a practical roadmap, the council can be more proactive in the decisions it makes,” he said.
The programme’s initial outputs are expected to give Solihull a ranked view of where AI could be applied across services, the level of organisational readiness, and which projects may warrant further consideration. This first phase is focused on identifying options rather than moving directly into deployment.
For local government leaders, that distinction is becoming increasingly important as councils test AI in areas that affect vulnerable residents and essential public services. In Solihull’s case, the work spans some of the authority’s most visible functions, including care services, children’s provision, public health activity, and parts of local infrastructure planning.
The council aims to use the findings to inform later investment decisions through finance-validated business cases and a practical roadmap for future priorities.
-
Business & Technology3 weeks agoHSBC UK & Visa test AI shopping with live payments
-
Business & Technology3 weeks agoValarian lands USD $50 million backing for sovereign AI
-
Business & Technology4 weeks agoMouser warns against viral hacks to cool overheating phones
-
Oxford News4 weeks agoNew romantasy bookshop attracts queues of customers
-
Business & Technology4 weeks agoSNP & Palantir launch AI tools for SAP transformations
-
Business & Technology4 weeks agoKane tops England influencer rankings after Mexico win
-
Traffic & Transport4 weeks ago‘I felt my spine and body split’: the woman who was hit by a child on a Lime bike – and denied compensation | Ebikes
-
Oxford News4 weeks agoDWP now checking bank accounts for Universal Credit and Pension Credit