National Cybersecurity Architectures Revisited: Coordination, Centralisation, and Institutional Evolution

National cybersecurity is inherently distributed across institutions with distinct mandates, capabilities, and security regimes, creating a persistent organizational problem of how to integrate specialized actors without excessive fragmentation or concentration. This study reassesses six alternative national cybersecurity architectures against subsequent institutional development. The empirical baseline is an Analytic Hierarchy Process assessment of 88 experts interviewed in 2018–2019, complemented by longitudinal documentary analysis and participant observation of Bulgaria’s cybersecurity governance from 2011 to 2026. Experts ranked a model combining operational cooperation with coordinated capability development highest under all five criteria—effectiveness, efficiency, resilience, agility, and cooperation—while the weakly coordinated status quo ranked lowest. The longitudinal analysis shows that Bulgaria did not converge on any single model. Formal arrangements oscillated between coordination and centralisation, while civilian decision authority and technical capability became progressively concentrated in different institutions and coordination mechanisms remained comparatively weak. This authority–capability decoupling reveals a governance risk when formal authority is not matched by sufficient public specialist capacity, independent assurance, and resilient alternatives. The findings support distinguishing coordination, centralisation of authority, and concentration of capability as separate dimensions of national cybersecurity architecture and suggest that regulatory compliance and institutional concentration cannot substitute for coordinated capability development.