Cybersecurity: a research agenda for the management of urban tourism destinations

Cyberattacks are becoming a growing concern for tourism cities, their infrastructure, their residents, visitors and business ecosystem. As a result, cyberthreats should be treated as a preventive governance and management priority rather than solely as a technical responsibility of individual businesses or destination management organisations. This viewpoint examines cybersecurity challenges affecting urban tourism destinations, with particular attention to destination management organisations, visitor safety, critical infrastructure, and sensitive personal data. It argues that the growing severity of cyber incidents, alongside emerging risks associated with artificial intelligence and quantum computing, require stronger coordination and a cultural shift among key destination stakeholders. This viewpoint article conceptualises destination cybersecurity governance as a collective, ecosystem-level challenge involving tourism businesses, public agencies, technology providers, residents, and visitors. It also explains how organisational and technological interdependencies allow cyber risks and impacts to propagate across tourism cities and suggests a six-part research agenda. The research agenda proposed addresses aspects of technological and organisational preparedness, coordinated incident response, third-party and supply-chain risk, data minimisation and lawful retention, consent and interoperable data ecosystems, as well as aspects related to regulation, enforcement, and traveller trust. Together, these contributions provide a governance-oriented foundation for future interdisciplinary research and practical action aimed at developing safer, more accountable, and resilient urban tourism destinations.