Understanding the plural landscape of cybersecurity governance in Spain: a matter of capital exchange

This paper empirically explores the contribution and collaborative networks of public and private actors to cybersecurity provision in Spain. The article draws on data from three sources: policy and legal documents, a Delphi study with cybersecurity experts, and 34 interviews. Rooted in the theoretical underpinnings of nodal governance and anchored pluralism, the paper argues that the position of actors and public-private collaboration dynamics involved in cybersecurity governance can be understood through the analysis of capital exchange. Therefore, the study provides a list of the most relevant nodes for cybersecurity in Spain, assesses the capital they possess and how they exchange it through collaborative networks and explores the characteristics and barriers of these collaborative relationships. Analyses reveal that public organisations hold a preeminent position in cybersecurity governance despite large technology corporations’ greater economic and cultural capital. Remarkably, the paper identifies the central position of new public bodies in the network of cybersecurity nodes. Moreover, cultural barriers that are hindering public-private collaboration in Spain are identified. These results indicate that, despite the state’s difficulties in providing public solutions to cybersecurity challenges, Spain is an example of how governance can be anchored in public bodies through symbolic and social capital.