A cybersecurity decision-support framework for technology integration in the built environment

Built environments are undergoing increasing digitalization across their lifecycle, from design to construction and to operations and maintenance (O&M), with the increasing use of information technologies (IT) and operational technologies (OT) and their convergence in recent years. While this transformation improves efficiency, enhances quality, and supports decision-making, it also expands the cyber threat surface. The increasing number of cyberattacks targeting the sector indicates the growing interest of malicious actors. This trend can be explained by the industry's relatively low cybersecurity preparedness and awareness, which make it an easy target. Moreover, the cybersecurity knowledge required to support decision-making is fragmented and distributed across both structured and unstructured sources, including human experience and cybersecurity documents, such as standards, guidelines, and frameworks. To address these challenges, this dissertation proposes a systematic framework to support cybersecurity decision-making for technology integration in built environments by utilizing these different types of cybersecurity knowledge. While the framework is intended to be applicable across the built environment lifecycle, the case studies in this dissertation focus on OT used during the construction phase, where cybersecurity concerns remain underexplored despite their potential safety, operational, and financial consequences. To justify the need for cybersecurity research for OT in the construction industry, the dissertation begins with a systematic review. This review reveals a lack of focus on the construction phase in construction cybersecurity research and the absence of cybersecurity considerations in construction automation studies. The dissertation then investigates the potential of crowdsourcing in utilizing cybersecurity knowledge for construction. A scoping review and thematic analysis show that, although crowdsourcing has significant potential for cybersecurity across industries, its application in construction has been limited. Building on this foundation, the dissertation uses the Hack My Robot competition as a case study to demonstrate how a cybersecurity competition can function as a crowdsourcing mechanism for extracting insights into vulnerabilities, threats, and mitigation strategies relevant to OT in construction. For this purpose, a repeatable text analysis pipeline that combines semantic segmentation and topic modeling is proposed. The dissertation then develops the first major building block of the proposed framework by introducing a web-based crowdsourcing platform that collects unstructured cybersecurity knowledge via structured, open-ended questions. The platform was implemented among the employees of a large contractor that deploys robotic systems on its sites. A reproducible analysis pipeline transformed free-form responses into management-oriented cybersecurity recommendations. These recommendations were then mapped to the ISA/IEC 62443 foundational requirements and evaluated through expert validation to assess how comprehensively internal crowdsourcing can capture OT-related cybersecurity needs in construction. Finally, the dissertation develops the second major building block of the framework by systematically identifying and utilizing structured cybersecurity knowledge. Before proceeding with the proposed approach, the dissertation examines the cybersecurity risks associated with large language model-based chatbots, such as ChatGPT, in the construction industry through a bibliometric analysis. The findings indicate the need for more secure alternatives to leverage structured knowledge. Then, a semi-automated, human-in-the-loop methodology is proposed to identify and prioritize relevant cybersecurity documents for different types of OT and construction processes through a taxonomy. A retrieval-augmented generation (RAG) workflow is developed to connect the identified cybersecurity documents with recommendations derived from unstructured human knowledge via the web-based crowdsourcing p atform. The workflow includes a two-level (context and evidence) structure-aware chunking strategy, combined with a hybrid retrieval approach (dense + sparse), to yield higher Recall and Mean Reciprocal Rank (MRR). Overall, the dissertation demonstrates how unstructured and structured cybersecurity knowledge can be systematically combined to support decision-making for technology integration in construction and through the built environment lifecycle.