Toward a cultural cyber-critical ecosystem: concepts, threats and challenges

Purpose The purpose of this paper is to introduce and formalize the Cultural Cyber-Critical Ecosystem (C3E) as a conceptual and operational framework for understanding Cultural Heritage as a cyber-critical domain. This study specifically addresses cyber-cognitive threats, identified as a pressing yet largely underexplored risk to the long-term preservation, integrity and intelligibility of Digital Cultural Assets (DCAs). Design/methodology/approach This paper adopts a conceptual and analytical approach grounded in systems theory, resilience engineering and digital heritage studies. Core C3E concepts are mapped against emerging cyber-cognitive threat vectors using dependency analysis and the Functional Resonance Analysis Method (FRAM). Hybrid Infrastructures, such as DARIAH-IT, are examined as empirical reference cases to illustrate how human, cyber and physical layers interact across the full DCA life cycle. Findings The analysis demonstrates that Cultural Heritage infrastructures exhibit critical dependencies not only at technical and organizational levels, but also at semantic, cognitive and trust levels. Cyber-cognitive dependencies – arising from human–AI interaction, distributed decision-making and semantic mediation – represent significant vulnerability channels capable of triggering cascading failures. At the same time, when properly governed, these dependencies enable resilience, adaptive capacity and long-term meaning preservation. The findings support the characterization of advanced heritage infrastructures as Hybrid Infrastructures with Critical Infrastructure properties. Originality/value The paper provides the first conceptualization of Cultural Heritage as a Cultural Cyber-Critical Ecosystem. By explicitly integrating cyber-cognitive threats, dependency taxonomies and resilience modeling, it extends existing digital heritage and FAIR-based approaches toward a critical-infrastructure perspective. The C3E framework offers scholars, cultural operators and policymakers a novel lens for analyzing risk, trust, resilience and sustainability of digital cultural heritage. The novelty of C3E lies in four distinct contributions that collectively go beyond any single predecessor: (i) it reconceptualizes Digital Cultural Assets as cyber-cognitive targets – not merely technical objects to be preserved – introducing an adversarial dimension absent from digital preservation frameworks such as OAIS (ISO 14721) and FAIR; (ii) it applies Critical Infrastructure Protection (CIP) logic to the cultural domain by formalizing dependency taxonomies, cascading failure paths and resilience engineering principles (AMRL) that are structurally absent from heritage-specific frameworks; (iii) it grounds socio-technical systems theory in an explicitly mission-driven, governance-accountable model, operationalizing the human–cyber–physical layers through FRAM-based functional analysis rather than treating them as purely descriptive categories; and (iv) it introduces analytically novel constructs that have no direct equivalents in OAIS, FAIR or conventional CIP frameworks.