Evaluating research security as enterprise risk management

Brendan Walker-Munro

doi:10.1080/13669877.2026.2660335

Higher education institutions (HEIs) are no strangers to risk managementpractices; however, recent geopolitical trends have resulted in HEIs need-ing to manage risks from hostile State-sponsored intelligence actions,such as espionage, foreign interference, hacking, and intellectual propertytheft. This in turn has led to many Western nations enacting processesand procedures for ‘research security’; that is, the protection ofsecurity-sensitive research through controls such as export limitations,sanctions, visa regulations, and funding policies. However, scholarly dis-section and discussion of precisely how research security is done is dis-tinctly lacking. This article conceptualises ‘research security’ as a form ofrisk management – specifically enterprise risk management (ERM) – inthe HEI context. It aligns research security with previous scholarly con-sensus on ERM, embeds the practice of research security in an ERMlandscape, and makes a number of propositions related to the mannerof regulating the protection of sensitive research in an ERM framework.The utility of this examination is threefold. Firstly, it applies intellectualrigour to an emerging discipline that has lacked a coherent policy frame-work. Secondly, it aligns research security to the wealth of scholarly outputon ERM (and offers opportunities for future explorations). Thirdly, itembeds in research security discourse the need for a nuanced and grad-uated discussion about risk that is largely absent from existing debates.

Evaluating research security as enterprise risk management

(1)