The European View of Cyber Conflict: The “Cyberwar” Books by Sandro Gaycken

A note before we start: both volumes are in German. If you or your German-speaking colleagues read the language, they are worth the effort — and if you do not, be aware that the full argument exists at book length only in German, though Gaycken has published a number of English-language papers on cyber security policy and the cyber risks facing business.

Accounts of cyber conflict written from the United States reflect its intelligence institutions, its relationship between state and industry, and its strategic priorities. Reading a German account alongside them brings another institutional perspective.

Sandro Gaycken wrote from Berlin, has advised the German government and German industry, and starts somewhere else entirely. His subject is a Europe that is industrially exposed, institutionally cautious, and dependent on infrastructure it does not control.

For any organization operating across the Atlantic, that second perspective is the one usually missing.

What the books actually cover

The two volumes are designed to work together. Cyberwar: Das Internet als Kriegsschauplatz (Open Source Press, 2011) establishes the domain — how digital conflict actually functions as a military and strategic problem, rather than as the catastrophist scenario the popular coverage favors. Cyberwar: Das Wettrüsten hat längst begonnen (Goldmann, 2012) takes the argument forward into the arms-race dynamic and its consequences for states that are not the largest players.

Gaycken's training is in the philosophy of science and technology, and it shows in the most useful way: he is unusually careful about what is actually demonstrated versus what is asserted. He is skeptical of the more theatrical claims made in this field, and equally skeptical of the reassurance offered by vendors selling the remedy.

Three arguments matter commercially.

Industrial espionage matters where technical knowledge carries commercial value. The extraction of intellectual property is a relevant scenario for companies whose competitive position depends on engineering or process knowledge. It should be assessed alongside disruption and other threats, rather than treated as a single European priority.

Attribution and escalation are unresolved. A state that cannot confidently identify an attacker cannot respond proportionately, and Gaycken is clear-eyed about how much strategic doctrine rests on a problem nobody has solved.

Complexity is itself the vulnerability. His recurring structural point is that systems have been built to a level of interdependence that no one fully understands, and that security added afterwards cannot compensate for architecture chosen without it.

Why it matters for your risk posture

Read them for an industrial-espionage framing particularly relevant to businesses whose value lies in technical intellectual property. That emphasis needs to sit within a broader assessment: ENISA's September 2024 threat landscape also identifies threats against availability, ransomware and threats against data as leading concerns.

Read them for the transatlantic difference. Regulatory posture, disclosure obligations, the relationship between state and industry, and the acceptable role of intelligence services all differ meaningfully between the United States and Germany. An organization operating in both is subject to both sets of assumptions, and reading only the American literature leaves half the picture missing.

Finally, read them for the skepticism. Gaycken wrote the books as an academic rather than a vendor (he later founded a high-security IT company), and he is unimpressed by both the threat inflation that sells services and the complacency that follows a quiet year. That is a useful register for anyone assessing security claims commercially.

Gaycken’s industrial-espionage emphasis informs what a cybersecurity assessment should examine when a client’s value sits in engineering or process knowledge. Intellectual-property theft and disruption both belong in the assessment, with their relative priority determined by the client's assets and exposure. Threat intelligence is scoped to the client’s sector rather than drawn from a general feed. His transatlantic argument belongs in political risk assessment as well. The relationship between state and industry in Germany differs from the American model in ways that shape disclosure obligations and the help a company can expect.

Key takeaways

• Technical intellectual property needs its own threat assessment. Test the risk of extraction alongside disruption, with priorities based on the business's assets and exposure.
• Attribution is unsolved, and doctrine depends on it. Response strategies that assume you will know who did it are resting on an unresolved problem.
• Complexity is the vulnerability. Security bolted onto an architecture chosen without it cannot fully compensate. That is a design finding, not an operations one.
• The American literature is not the whole picture. If you operate transatlantically, the European institutional and regulatory frame is a separate body of knowledge.

About the author

Dr. Sandro Gaycken founded the Digital Society Institute at ESMT Berlin — a strategic research institute set up with backing from German industry — and served as its director; his work has centered on the intersection of technology, security and strategy. He was previously a senior researcher at the Freie Universität Berlin.

His ESMT faculty biography lists roles including Oxford Martin School Fellow, Senior Advisor to the AI Initiative at the Harvard Kennedy School, program committee member of the Harvard-MIT conference series on cyber defense and cyber norms, Senior Fellow of the German Council on Foreign Relations, and a directing role within NATO's Science for Peace and Security cyber defense program.

The same biography records that, as an adviser to the German government, he contributed to the country's foreign cyber policy strategy, testified as an expert witness in Bundestag hearings, and took part in the Ministry of Defence's cyber defense white book process, and that he has published five scientific monographs, three of them on cyberwarfare, alongside more than sixty other publications.