AI-Driven Decision-Support Framework for Cybersecurity Consulting Under Zero-Trust

Data Description

The study used publicly available UNSW-NB15 dataset were identity access logs and system events gathered from network traffic and user interactions, provided in the files UNSW_NB15_training-set.csv and UNSW_NB15_testing-set.csv. The official training set had 82,332 records, and a test set of 175,341 records. The training set was split into training and validation subsets, with 80% of the data used for training and 20% for validation, stratified randomly with random_state = 42. The ANN and CNN models have 42 event-level features, and the LSTM uses 10-step temporal windows, yielding 17,534 test sequences.

After preprocessing, the final dataset consists of 42 features. These features included authentication attributes, session metadata, network indicators, behavioural variables, access history information and risk-related contextual variables. After pre-processing, the number of event-level observations for ANN and CNN modelling was approximately 175,341, and the number of sequence-level observations for LSTM modelling was 17,534 after processing the temporal window.

The records for each event were then resized into a 10-step fixed-length temporal sequence for LSTM modelling. The train and test files were separated before generating the sequences to avoid temporal leakage. The sequence windows were defined independently in each partition, and no windows spanned from the training set to the test set. Thus, the events included in the training sequences were not repeated in the testing sequences. This enabled temporal windows with no overlap and ensured none between the training and testing data.

Event-level samples were extracted from the UNSW-NB15 test set and used to evaluate Random Forest, ANN, and CNN, and 10-step temporal sequence windows were generated from the same test partition for LSTM evaluation. As a result, the raw counts of false negatives cannot be compared across all models as they are based on varying numbers of test units. To prevent misinterpretation, the false-positive and false-negative rates are also reported, along with the raw FP and FN counts. Based on this, LSTM results should be viewed as sequence-level, while those of ANN and CNN should be considered event-level.

Data Pre-processing and CNN Input Preparation

Before model training, the UNSW-NB15 records were pre-processed to ensure consistency across the ANN, CNN, LSTM, and Random Forest experiments Table 1. The predefined training and testing files were kept separate throughout pre-processing to avoid information leakage. Missing values, duplicate records, and non-informative identifiers were checked before feature transformation. Categorical variables were encoded using one-hot encoding, while numerical variables were normalised using min-max scaling. The scaling parameters were fitted only on the training partition and then applied to the validation and test partitions. This ensured that no information from the test set influenced the training process.

Table 1. Model parameter settings used in the experiments.

Note: The CNN input was obtained by padding the 42-feature event vector to 49 values and reshaping it into a 7 × 7 × 1 matrix. The LSTM input was generated using non-overlapping 10-step temporal windows. The Random Forest model was used as a baseline classifier, while the ANN, CNN, and LSTM models were used as AI risk-scoring components in the Zero-Trust decision-support framework.

The final event-level feature matrix contained 42 input features after encoding and pre-processing. For ANN and Random Forest modelling, these 42 features were used directly as tabular input. For CNN modelling, the same 42-dimensional event-level vector was converted into a fixed two-dimensional representation so that convolutional filters could be applied consistently. Because 42 features do not form a perfect square matrix, zero-padding was applied to extend each feature vector to 49 values, after which it was reshaped into a 7 × 7 single-channel matrix. Thus, the CNN input shape was defined as 7 × 7 × 1 for each event. The padded values contained no attack information and were included only to preserve a consistent spatial input structure for convolution.

The CNN pre-processing procedure was designed to allow local neighbourhood patterns among transformed network and behavioural features to be learned by convolutional filters. Although the UNSW-NB15 dataset is tabular rather than image-based, reshaping the feature vector into a compact two-dimensional matrix allowed the CNN to model local feature interactions that may not be captured by a fully connected model alone. The same training, validation, and testing partitions were used for the CNN as for the ANN to ensure fair event-level comparison. Labels were binary-coded, where 0 represented normal traffic and 1 represented attack traffic.

For the LSTM model, the pre-processed event-level records were converted into non-overlapping 10-step temporal windows. The train and test files were separated before sequence generation so that no temporal windows crossed from the training partition into the test partition. This reduced the risk of temporal leakage and ensured that LSTM performance reflected sequence-level generalisation rather than overlap between training and test samples.

AI Model Development

The AI models in this framework were developed using a consistent supervised-learning workflow. The Random Forest model was used as a baseline, while ANN, CNN, and LSTM models were used as neural-network components of the proposed Zero-Trust decision-support framework. All models were trained using the same binary target variable, where 0 indicated normal traffic and 1 indicated attack traffic. The training set was divided into training and validation subsets using an 80:20 stratified split with random_state = 42. Model performance was evaluated on the held-out UNSW-NB15 testing set.

Random Forest

The Random Forest classifier was implemented as a conventional machine-learning baseline to compare neural-network performance against a non-deep-learning approach. The model used 100 decision trees, Gini impurity as the splitting criterion, and random_state = 42 for reproducibility. Class imbalance was addressed by reporting weighted precision, recall, and F1-score in addition to accuracy and AUC. The baseline model provided a reference point for assessing whether the ANN, CNN, and LSTM models offered additional predictive value.

ANN Model

The ANN model was designed to classify event-level records as normal or malicious using the 42 pre-processed input features. The network consisted of an input layer, two dense hidden layers, and one sigmoid output layer. The hidden layers used ReLU activation to capture nonlinear relationships among network, behavioural, and session-related features. Dropout regularisation was included to reduce overfitting during training. The final output layer used a sigmoid activation function to generate a probability score between 0 and 1, which was then interpreted as the ANN-generated risk score.

The ANN was trained using the Adam optimiser with a learning rate of 0.001, binary cross-entropy loss, a batch size of 64, and 15 training epochs. Validation accuracy and validation loss were monitored at each epoch to assess generalisation. The decision threshold for binary classification was set to 0.50, while the continuous probability output was retained for the Zero-Trust risk-score harmonisation layer.

CNN Model

The CNN model was used to learn local feature-interaction patterns from the reshaped 7 × 7 × 1 representation of each event-level record. The CNN architecture consisted of convolutional layers, max-pooling, flattening, dense layers, dropout, and a sigmoid output unit. The first convolutional layer used 32 filters with a 3 × 3 kernel and ReLU activation. This was followed by a max-pooling layer to reduce the feature map size. A second convolutional layer with 64 filters and a 3 × 3 kernel was then used to capture higher-level local feature interactions. The extracted feature maps were flattened and passed to a dense layer before final binary classification.

The CNN was trained using the Adam optimiser with a learning rate of 0.001, binary cross-entropy loss, a batch size of 64, and 15 epochs. Dropout was applied after the dense layer to reduce overfitting. The final sigmoid output represented the probability that an event belonged to the attack class. This probability was used both for binary classification and as the CNN risk score for subsequent Zero-Trust policy mapping.

LSTM Model

The LSTM model was developed to capture temporal dependencies across sequential network events. The pre-processed records were grouped into non-overlapping 10-step windows, and each window was labelled according to the corresponding attack status. The LSTM architecture included one LSTM layer followed by dropout, a dense hidden layer, and a sigmoid output layer. The LSTM layer was used to learn sequential patterns that may indicate evolving attack behaviour, such as reconnaissance followed by exploitation or repeated abnormal access attempts.

The LSTM model was trained using the Adam optimiser with a learning rate of 0.001, binary cross-entropy loss, a batch size of 64, and 15 epochs. The sigmoid output produced a sequence-level attack probability. Because the LSTM used sequence-level test units rather than event-level test units, its raw false-positive and false-negative counts were not directly compared with ANN, CNN, or Random Forest. Instead, rates such as FNR, weighted F1-score, and AUC were used for cautious comparison.

Risk Score Harmonisation Across Heterogeneous AI Models

The suggested structure uses heterogeneous AI models with native outputs of different structures and semantics. To allow the use of a single Zero-Trust policy, a risk score harmonisation layer is added to convert all model outputs to a shared scalar risk representation. This risk score is harmonised, enabling consistent, model-agnostic decision-making in the Zero-Trust Policy Decision Engine.

ANN Output Mapping

ANN gives a binary result of benign or malicious activity. The model produces a sigmoid activation output, which is used to transform this output into a probabilistic risk score:

where  is the ANN-generated risk score,  represents malicious activity,  is the input feature vector, and  is the sigmoid output.

CNN Output Mapping

The CNN generates a multi-class forecast based on threat intensity levels. The risk score is harmonised as a weighted average of the probabilities of classes:

where  is the predicted probability of class ,  is the severity weight assigned to that class, and  is the total number of threat classes.

LSTM Output Mapping

The LSTM model provides a temporal distribution of threat likelihoods. With the help of temporal aggregation, the harmonised risk score is calculated:

where  is the temporal window length and  is the predicted attack probability at time step .

The harmonised risk scores of the AI models are similar across architectures and output semantics, but they all share a common probabilistic interpretation: the probability or degree of compromise. Such an abstraction enables heterogeneous models to be used interchangeably within the Zero-Trust enforcement logic, retaining all their respective analytical strengths.

Integration with Zero-Trust Architecture (Zero-Trust Architecture)

The incorporation of the AI models into the Zero-Trust architecture is a significant aspect of this structure. The Zero-Trust Policy Decision Engine (ZTPDE) is a dynamically assessed policy engine that receives real-time data from AI models. The probability of an attack is assessed using the risk score generated by the ANN model, whereas CNN and LSTM models provide an understanding of attack patterns and sequences. The information is traced back to the Zero-Trust decision-making process to ensure that access is granted only to those who meet the least-privilege requirements and complete all necessary verification procedures. In this study, the rule-based security systems are conventional signature- or threshold-based detection systems that do not include adaptive AI-based risk scoring or enforcement of Zero-Trust policies.

A combination of Zero-Trust principles and AI enables dynamic, risk-based authentication: access rules are continually adjusted based on the current risk assessment. This ensures that organisations can react swiftly to incoming threats and counter potential breaches before they escalate. In this study, the outcome of automated access control generated by the Zero-Trust Policy Decision Engine (ALLOW, MONITOR, MFA, or DENY) in response to an AI-generated risk assessment is defined as a decision. The quality of the decision is thus measured with respect to (i) the accuracy in risk classification of the underlying risk, (ii) the suitability of the action taken as a result of the risk level and (iii) the consistency and promptness of the decision action to dynamic threat conditions.

Use of the Security Maturity Assessment (SMA) Tool

The Security Maturity Assessment (SMA) Tool is used to assess whether the framework effectively measures Zero-Trust maturity. The tool gauges the extent to which AI-generated choices comply with the principles of Zero Trust and compares AI models’ outputs against well-defined cybersecurity standards. The SMA Tool allows tracking AI results against Zero-Trust capability requirements, providing valuable feedback on the framework’s performance and areas for improvement.

Even though the concept of Zero-Trust maturity is generally understood as a continuous, multidimensional process, SMA in this work focuses on enabling capabilities rather than depth of maturity. A score of 1 means the framework provides a foundational Zero-Trust capability that is operational, and a score of 0 means it does not. The estimation thus depicts the achievement of low-level viable Zero-Trust functionality, rather than organisational maturity.

In this study, the Security Maturity Assessment (SMA) Tool is used as a structured capability validation tool, not as a quantitative maturity scoring model. Every dimension of SMA reflects the presence or absence of a core Zero-Trust capability (e.g., continuous verification, least privilege, adaptive access, and risk-based policy enforcement). In line with this, the assessment results are reported in a binary manner to indicate whether the proposed framework operationally supports the capability.

Binary scoring is adopted to reflect capability enablement rather than maturity depth. The objective of the SMA in this context is to validate whether the proposed framework operationally supports each Zero-Trust principle, not to rank organisations along a maturity continuum. As such, weighting schemes and composite maturity indices are intentionally not applied, as they are typically used in organisational benchmarking studies rather than artefact validation.

Simulation & Scenario Analysis

The evaluation process includes simulated sequences of cyber-attacks. These codes consist of the popular attack types: phishing, credential stuffing, and malware execution. These simulations are tested within the framework, and key performance indicators (KPIs) are measured, including detection speed, analyst response time and false-positive reduction. The simulations are used to test the effectiveness of the AI-based decision-making framework in real time, identify the threats, and help mitigate them. For example, the detection speed of an AI model is the time it takes to identify a cyber-attack upon its occurrence.

In contrast, the speed of analyst response is measured by the time it takes cybersecurity specialists to act on the AI model’s recommendations. Also, the false-positive rate is monitored to ensure the system does not inundate security teams with false messages. The simulation scenarios are intended to represent various phases of the cyber-attack lifecycle, rather than isolated threat labels. All simulated scenarios are operational versions of the broader threat classes described elsewhere in the paper. The mapping between the threat classes in the high-level and their respective simulated attack scenarios is summarised in Table 2, thereby ensuring consistency between the conceptual threat taxonomy and the empirical evaluation design.

Table 2. Threat taxonomy and simulation mapping.

Mathematical Integration and Data Flow

The mathematical combination of AI-generated outputs with the Zero-Trust framework works in the following way:

1. Risk Score Calculation: The AI models (ANN, CNN, LSTM) provide a risk score that quantifies the likelihood of an attack. These scores are normalised to the range 0 to 1, with 1 indicating a high probability of an attack.
2. Policy Mapping: These are then mapped onto Zero-Trust policies. For example, a score above a specific threshold (g., 0.75) could trigger multi-factor authentication (MFA) or limit access in accordance with the least privilege doctrine.
3. Access Rule Enforcement: After the AI model maps to a decision, the Zero-Trust system enforces access rules based on the result, dynamically responding to evolving threat conditions.

Pseudo-Algorithm

1. Input: Raw network traffic data, user behaviour logs, system events
2. Pre-processing: Clean and normalise data
3. Model Prediction:

• ANN: Identify the risk as an innocuous or malicious one.
• CNN: Find patterns of attack on logs.
• LSTM: Forecast sequential threats

4. Risk Score Calculation: The model’s outputs are normalised to a risk score (0-1).
5. Zero-Trust Evaluation: Map risk to the Zero-Trust policy decision engine.
6. Access Rule Enforcement: Implement access control (e.g., deny, MFA, monitor)

PROPOSED AI-DRIVEN BUSINESS ANALYSIS FRAMEWORK

The proposed framework is developed as a cybersecurity operations decision-support system using AI. It combines the risk-prediction capabilities of ANNs, CNNs and LSTMs with a Zero-Trust Policy Decision Engine for adaptive access-control decisions. The framework is not intended to give a holistic business-consulting or financial-optimisation model. Rather, it is about combining disparate AI outputs to create a single set of risk scores, then correlating those scores with different levels of enforcement during a simulated cyberattack.

Framework Overview

The suggested AI business analysis model easily fits into a Zero-Trust framework, while also introducing predictive risk analytics to improve cybersecurity decision-making for consulting firms. This design was broken down into 5 main layers: Data Collection Layer, AI Prediction Engine, Zero-Trust Decision Layer, Business Intelligence Layer, and Consulting Dashboard. All layers are needed for cybersecurity advisors to have access to accurate, up-to-date data that is relevant enough to aid in informed decisions.

At the core of the framework is the Data Collection Layer, responsible for collecting all critical data from network traffic logs, system events, user actions, and multi-factor authentication (MFA) signals. This data is updated and purged on an on-going basis to ensure that it is retained and available for analysis. The data was fed to the AI Prediction Engine which executed a machine learning model with Artificial Neural Networks (ANNs), Convolutional Neural Networks (CNNs), and LSTM (a particular Recurrent Neural Networks (RNN)). These models forecast the chances of cyberattacks and, thus, help cybersecurity experts anticipate threats in advance of their appearance. The forecasts are coupled to the Zero-Trust Decision Layer, which allows access and applies security policies based on the AI engine’s real-time analysis of them.

The Zero-Trust Decision Layer includes continuous checking of all access requests (internal and external). This layer is based on a least-privilege model (EL), so that users have access only to sensitive systems and data that are approved. The Business Intelligence Layer incorporated AI models and Zero-Trust policy outcomes and deliver substantive information to consultants. It has cost-risk forecasting tools, ROI analysis of cybersecurity investments and recommended security controls. Last but not least, the consulting dashboard is the interface that cybersecurity professionals can use to access real-time visualisations of risks and threats, as well as mitigation strategies. This layer allows consultants to quickly and accurately decide on the security data, giving a wider overview of the organisation’s security position.

Predictive Risk Analytics Layer

The most crucial part of the framework is the Predictive Risk Analytics Layer that calculates threat probabilities and produces a risk heatmap in real time. Using AI models, this layer allowed threats from different cyberattacks, such as credential stuffing, DDoS attacks and phishing, to be identified. The threat probability score is a numerical value that reflects the likelihood of an event occurring, given historical and current dynamics of the network. This score can be used to prioritise security activities with the highest likelihood of occurrence and deal with them in advance.

AI models generate risk heat mapping to show the distribution of risk across the organisation’s IT assets. These heat maps help cybersecurity experts identify high-risk systems, areas for weak access and/or areas that need urgent policy intervention. They are continually refreshing themselves with the information they receive, giving cybersecurity consultants a real-time view of where the network is weak. The tool for visualisation makes it easy to identify high risk areas and to allocate resources accordingly for security officers. Predictive risk analytics within the wider Zero-Trust model can enable the consultant to detect potential risks in time, enabling a faster response and greatly curbing the impact of the cyberattack.

Zero-Trust Decision Layer

The Zero-Trust Decision Layer combines AI-based forecasts with Zero-Trust security concepts to provide an all-in-one solution for access control and user authentication. Some of the features that render this layer as one of the most crucial ones include the ability to utilise multi-factor authentication (MFA) in case an abnormal pattern or a possible threat is identified by the AI models. To illustrate, the Zero-Trust system can provide an additional verification process for granting sensitive resources to the user based on a risk score produced by the AI model that exceeds a predetermined threshold. This ensured that, even if an attacker breaches the network perimeter, multiple authentication steps were required before they gain access to the network.

The Zero-Trust Decision Layer can also be used to block access to suspicious users or devices in addition to MFA. In case of abnormal behaviour identified by the system, e.g., abnormal time or place of logging in, access to relevant systems can be cancelled on the spot. The Zero-Trust Architecture also includes a trust score recalibration option; it continuously assesses the reliability of users and devices based on behaviour and threat levels. Access policies are also constantly updated to reflect the most current risk assessment through recalibration, enabling security to be applied dynamically in real time.

Business Consulting Decision Support Layer

The Operational Decision-Support Layer helps convert AI-driven risk scores into meaningful Zero-Trust decisions. It is not there to optimise financial returns or to forecast business performance, but to facilitate cybersecurity operations by enhancing the consistency, proportionality and timeliness of access-control decisions. The outputs of the ANN, CNN and LSTM models are translated into common risk semantics in this layer and sent to the Zero-Trust Policy Decision Engine. The engine then translates each risk score into an enforcement action from four options: ALLOW, MONITOR, MFA, or DENY.

This layer provides operational benefits by reducing the need for binary allow/deny decisions and enabling a graduated response when encountering events that are uncertain or pose increased risk. Low-risk access requests can be granted; medium-risk access requests can be tracked; high-risk access requests may require multi-factor authentication; and critical-risk access events can be denied. The graduated enforcement process enables security teams to handle risk without interfering with the normal functioning of activities. It is also aligned with Zero Trust, as it continually verifies trust based on observed behaviour and changing threat conditions.

The layer can also enable future cybersecurity consulting applications by providing an understandable output that analysts or consultants can review during a security evaluation. However, in this study, the use of dashboards, ROI estimation, cost-risk forecasting, and business KPI optimisation are considered practical extensions of the deployment for the future and are not empirically proven. Only the operational capability of the decision-making framework, model performance, risk-score harmonisation, access-control behaviour, trust recalibration and policy-decision latency are considered in the present evaluation.

Operational Workflow

The business analysis process of the proposed AI-based system follows a cyclic scheme, is smooth and involves all levels of the unified system. The first level of the workflow is data collection, where real-time data is gathered from network logs, user behaviour, and system events, and then cleaned. This information is then fed to the AI models to generate risk forecasts, which are sent to the Zero Trust Decision Layer for review, and the control decision is determined.

As the AI models run, the system continuously updates trust scores, and MFA or access is enabled or denied accordingly. They are then presented to the consultants through the Consulting Dashboard, where the risk heatmaps, cost-risk forecasts, and recommendations can be viewed. The resulting decisions are returned as operational outputs to support analyst review and refine security policy. The framework thus helps support cybersecurity teams by enabling the conversion of AI-driven risk scores into enforceable Zero-Trust actions. The output of this study is limited to the empirical context of consulting dashboards for resource allocation planning or cost-risk forecasting, and these aspects of the topic should be explored further in the future.

RESULTS

To demonstrate the applicability of the proposed AI-enhanced business analysis framework, it is possible to simulate cyber-attack cases. These simulations employ a holistic architecture approach to understand the framework and improve detection, response time, and decision-making accuracy in real-life cybersecurity threats. Results from these simulations demonstrate significant improvements in attack detection and response, and the framework can make decisions more quickly and effectively than the traditional security framework.

In cybersecurity consulting, the objectives of business analysis are directly reflected in these results, despite the technical aspects of performance being the focus of the experimental evaluation. Detection accuracy, Zero-Trust enforcement behaviour, trust recalibration, maturity progression, and decision latency are metrics of operation ineffectiveness, governance maturity and decision reliability, which are the focus of consultant-based risk evaluation and advisory services.

ANN Model Accuracy and Performance

The Artificial Neural Network (ANN) model achieved a test accuracy of 87.94%, as reported in the classification report. The model had a steep training vs. validation accuracy curve, similar to the ANN’s accuracy plot, because both the training and validation datasets increased steadily. The model also showed initial overfitting, as indicated by a rapid increase in training accuracy, but this decreased as training continued. The validation accuracy then approached the train model’s suitability for categorisation, as shown in the loss curve, which showed a sharp drop in both the training and validation losses, indicating successful learning from the input features. Figs. (2 and 3) show the accuracy and loss convergence curves, respectively, and illustrate the ANN model’s learning behaviour over training epochs.