Beyond Institutional Constraints Epistemic Trust in Cyber Civil–Military Relations

Cybersecurity cooperation increasingly depends on coordination among civilian, military, and private-sector actors. Yet cooperation often remains difficult even where formal mechanisms for information sharing and coordination are well established. Existing explanations primarily focus on institutional arrangements, legal frameworks, and resource constraints. This article argues that such approaches overlook a fundamental challenge of the cyber domain: the dispersion of expertise across multiple sectors. Because no single actor possesses all the knowledge required to identify, assess, and respond to cyber threats, organisations must increasingly rely on expertise produced outside their own institutional environments. Building on the concept of epistemic trust—the recognition of others as legitimate producers of credible and actionable knowledge—the article examines civil–military cybersecurity cooperation in Lithuania, Spain, Hungary, and Slovenia. Despite significant variation in cybersecurity maturity, institutional design, and governance arrangements, similar patterns of mistrust, cultural divergence, and contested expertise emerge across all four cases. The findings suggest that these tensions stem not only from institutional or material constraints but also from the challenges of recognising and relying upon knowledge produced according to different professional norms and organisational logics. Cybersecurity therefore creates conditions of epistemic dependence that place new pressures on civil–military cooperation. The article concludes by identifying policy measures aimed at strengthening cross-sectoral trust and improving cooperation across institutional boundaries. AcknowledgementsThis work has been carried out within the COcyber project (Coordination Between the Cybersecurity Civilian and Defence Spheres), which has received funding from the European Union’s Digital Europe Programme (DIGITAL) under Grant Agreement No. 101158606 (Call DIGITAL-ECCC-2023-DEPLOY-CYBER-04).Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Cybersecurity Competence Centre (ECCC). Neither the European Union nor the granting authority can be held responsible for them.