The paper maps these gaps and discusses how user-centred cybersecurity interventions and policy communication could better align stakeholders across the three levels of the Danish defence supply chain.

Huge credit to Judith for leading this work. Thanks also to Peter Mayer for co-supervising the project with me, and to the rest of the team for their collaboration.
We are also grateful to Industriens Fond for supporting this research.

See you in Barcelona at #CHI2026

🧵3/3

• Policymakers frame cybersecurity as strategic national resilience
• SMEs often experience it as costly compliance work
• Industry associations sit in the middle trying to translate policy into something companies can realistically implement

These misaligned mental models shape how cybersecurity policies travel from strategy to practice. Even well-designed policies can fail if stakeholders don’t share the same understanding of risks, responsibilities, and priorities.

🧵2/3