Bringing security research closer to society
Security affects all of us. It shapes how we live, communicate, use technology and respond to crises. Yet research on security often remains within universities, academic journals and expert communities. The Science for Security Festival brings this knowledge beyond academia. We make research on contemporary security challenges accessible to a wider audience and create a space where researchers, students, young people, practitioners and the public can meet, exchange ideas and learn from one another.
What is the Science for Security Festival?
The Security Science Festival is a science communication initiative dedicated to sharing research and knowledge in the field of security. We see security as a broad and interdisciplinary field. It includes defence and international security, but also cybersecurity, disinformation, new technologies, social resilience, crisis management and the many ways in which security becomes part of everyday life. Our aim is not simply to make academic knowledge easier. We want to explain complex issues clearly without losing their complexity, encourage questions and show how research can help us understand the challenges we face.
Our mission
Making research accessible. We translate research findings and academic debates into formats that can reach audiences beyond academia.
Connecting science and society. We create opportunities for researchers to share their knowledge and for the public to engage directly with people who study security.
Engaging the next generation. We want young people to discover how research works, why evidence matters and how security science can help us understand the world around us.
What do we talk about?
Explore security studies
Security is not only a matter for governments, armed forces or experts. Our everyday decisions, technologies, information environments and social relationships also influence how secure and resilient our societies are.
Cybersecurity & new technologies
How digital technologies, artificial intelligence and the growing dependence on connected systems create new opportunities as well as new vulnerabilities.
War, defence & international security
How armed conflicts, geopolitical competition and changes in the international environment affect states, institutions and societies.
Societal resilience
Why trust, social cohesion, education, institutions and communities matter when societies face crises and security threats.
Crisis & risk
How individuals, organisations and states prepare for crises, communicate under uncertainty and respond when security is disrupted.
Security is often associated with the state: armed forces, borders, intelligence services, policing, emergency response, or protection against major crises. For most people, however, security is experienced much closer to home. It affects whether we can move freely through public space, keep our property safe, work and travel, use banking services, communicate with others, trust the information we receive, and rely on essential services when something goes wrong. Increasingly, it also concerns what happens when we unlock a phone, open an email, make an online payment, share personal information, or use a digital public service. Security is therefore not only a matter of national strategy. It is also a condition of ordinary life.
Security studies have gradually moved away from defining security simply as the absence of war or immediate danger. Polish scholars such as Józef Stańczyk, Ryszard Zięba, Stanisław Koziej, Waldemar Kitler, Ryszard Szpyra, and Jacek Pawłowski have contributed to a much broader understanding of the concept. Security may be considered a condition, a need, a value, and a goal, but it is also a process. Security is never achieved permanently. The environment changes, new technologies appear, institutions evolve, and threats that once seemed marginal may acquire greater significance. The literature therefore treats security not only as a question of whether a subject is safe at a particular moment, but also of how that subject maintains and improves its capacity to function over time. Security can be examined as a state, a process and a need, and that its meaning changes depending on the subject and sphere under examination.
Security entails confidence in a subject’s existence, survival, possessions, functioning, and prospects for development. It does not result only from the absence or elimination of threats. It also depends on what the subject does to create favourable conditions for itself. Security therefore has a social and temporal character: it changes and has to be continually produced. This distinction leads to two different ways of thinking about security. A negative conception concentrates on protection from threats: security exists because something harmful has been prevented or removed. A positive conception goes further. It asks whether individuals, societies, and states possess the conditions needed not merely to survive but to function, exercise their freedoms, and develop.
The positive understanding is useful when we bring security down to the level of everyday life. A person may face no immediate physical threat and still experience considerable insecurity because of unstable access to income, healthcare, housing, reliable information, digital services, or social support. Conversely, security is strengthened not simply when danger disappears, but when people have realistic possibilities to organise their lives, make decisions, recover from disruption, and plan for the future. In this sense, security is closely connected with agency: the ability to act rather than simply to be protected.
One way of making sense of such a broad concept is to ask three simple questions: Whose security are we discussing? What are we trying to protect? And through what actions and institutions is security produced? These questions correspond broadly to the subject, object and process dimensions found in security studies. Classifications distinguish personal, local, national and global levels, different substantive areas of security, and processual and organisational dimensions. These distinctions may sound theoretical, but they have direct practical value. If the subject is an individual, the things to be protected may include life, health, privacy, property, identity, family relations, employment and autonomy. For a company, the priorities may include staff, information, reputation, financial stability and continuity of operations. For a state, they extend to sovereignty, territorial integrity, constitutional order, public institutions, critical infrastructure and the ability of society to function. The levels overlap. A cyberattack against a hospital is simultaneously a problem for an organisation, a threat to individual patients, a potential public-security concern, and, if disruption is sufficiently widespread, an issue for national resilience. This helps explain why contemporary security can no longer be divided neatly into isolated categories. The material, social, institutional and informational parts of daily life increasingly depend on one another. A prolonged electricity failure becomes a communications problem. A disruption to digital payments becomes an economic and social problem. An attack on transport infrastructure may become a public-safety problem. Manipulated information may affect individual decisions, trust between social groups and confidence in public institutions. A useful security analysis therefore does not simply identify a threat. It asks how consequences may move between different parts of a larger system.
This broader approach also connects security studies with the concept of human security. The 1994 UNDP Human Development Report explicitly shifted the focus from the security of territories towards the security of people and from weapons towards human life and development. Human security was associated particularly with freedom from fear and freedom from want and encompassed economic, food, health, environmental, personal, community and political concerns. The concept has been debated because such a broad definition can make almost every serious social problem a security issue. That criticism should be taken seriously. Nevertheless, human security made an important contribution by reminding security studies that state security and individual security are related but cannot simply be treated as the same thing.
Security depends not only on what threatens us but also on whether we recognise the threat correctly. Therefore, objective and subjective security can be distinguished: the actual presence of threats to valued interests and the fear that those interests may be attacked. A person may therefore be objectively vulnerable while feeling perfectly safe, or may experience intense insecurity even when the actual level of danger is relatively low. When a serious threat exists and is correctly recognised, there is genuine insecurity. When a minor threat is perceived as severe, an “obsession” with danger develops. More relevant to many contemporary security problems is false security: a substantial threat exists but is underestimated or not recognised at all. The most desirable situation is one in which the objective threat is low and its assessment is broadly accurate.
Digital life provides many simple examples of false security. A person may reuse the same password across numerous accounts for years without experiencing an incident and conclude that the practice is safe. Yet the absence of previous harm says little about current exposure. The same applies to delayed software updates, unsecured devices, excessive sharing of personal information, or unquestioning trust in messages that appear to come from familiar institutions. Nothing may happen for a long time, but vulnerability is still present.
The reverse problem also matters. Security communication can exaggerate risk. Constant warnings, emotionally charged reporting and misleading information can create an impression of permanent crisis. This matters because the goal of security policy or education should not be to make people afraid. Excessive fear may itself impair judgement. A more mature security culture depends on proportionate threat assessment: recognising serious danger without treating every uncertainty, technological change or unfamiliar event as a threat.
The distinction is particularly relevant to disinformation. Disinformation does not necessarily create a cyber incident in the technical sense, but it can affect the subjective dimension of security. It may exaggerate certain dangers, conceal others, undermine confidence in reliable institutions, or distort the way people assess responsibility and risk. The relationship between information and security therefore extends beyond the protection of computer systems.
One of the major developments in security studies has been the expansion of the security agenda beyond military threats. In international scholarship, Barry Buzan, Ole Wæver and Jaap de Wilde distinguished military, political, economic, societal and environmental sectors. Polish security studies have similarly developed multidimensional and systemic approaches, including research by Kitler and scholars associated with the former National Defence University and the War Studies University. Kitler’s work on national security, for example, explicitly addresses the political, military, economic, social, environmental, cultural, public and societal dimensions of national security rather than reducing the field to defence alone.
The point of distinguishing these dimensions is analytical, not to suggest that they function independently. In reality, they are deeply interconnected. Economic security depends on energy and communications. Public safety increasingly depends on functioning information systems. Health services depend on digital networks and supply chains. Military security depends on civilian infrastructure. Social stability depends partly on access to trusted information and functioning institutions. Digital infrastructure now cuts across almost all of these domains. This is also why the meaning of security changes over time. What societies regard as a significant security concern reflects changes in technology, institutions, social expectations and patterns of dependence. The supplied literature makes this point explicitly in relation to public security: as social life changes, new dangers emerge and the substantive meaning of security also evolves. Cybersecurity is one of the clearest illustrations. Problems that thirty years ago would have belonged to a specialised technical domain now affect almost every citizen and virtually every major public institution.
A smartphone illustrates how thoroughly physical, social and digital security have become connected. It may simultaneously function as a communication device, camera, wallet, banking terminal, authentication tool, navigation system, archive, workplace and gateway to public services. Losing control of such a device can therefore expose far more than the device itself. It may provide access to money, correspondence, personal photographs, professional documents, social networks and other accounts.
For this reason, cybersecurity should no longer be presented simply as the protection of computers. The current legal framework in Poland also supports a broader understanding. Following the amendment to the Act on the National Cybersecurity System that entered into force on 3 April 2026, Polish law defines cybersecurity by reference to the EU Cybersecurity Act. Under that regulation, cybersecurity means the activities necessary to protect network and information systems, their users and other persons affected by cyber threats.
For the individual user, however, the consequences are rarely experienced in technical categories. A compromised email account may give an attacker access to other services. A fraudulent payment request may produce an immediate financial loss. Identity theft may create longer-term legal and economic problems. The loss of private information may cause reputational or personal harm. A ransomware incident affecting a hospital may interrupt treatment; one affecting a local authority may interfere with essential public services. Cybersecurity therefore protects many familiar values: privacy, property, identity, autonomy and access to services in a new environment.
At the same time, it is useful to resist the temptation to place every harmful digital phenomenon under the heading of cybersecurity. Cybersecurity and information security overlap, but they are not identical, and neither should automatically be equated with the problem of disinformation. A false claim circulating on social media may be harmful without compromising a computer system. It may instead threaten informational or cognitive security, distort decision-making, or contribute to social polarisation. A coordinated influence operation may combine such activities with hacking or data theft, but the analytical categories should still be distinguished. Clear concepts matter because different problems require different forms of response.
Everyday cybersecurity also raises the question of responsibility. It is common to hear that “the human is the weakest link” in cybersecurity. This phrase captures one real problem. Many attacks exploit human behaviour, but it is also misleading because it suggests that security failures can be explained mainly by user error. People act within systems designed by organisations. Their decisions are shaped by time pressure, workload, interfaces, organisational procedures, training and the information available to them. If a system makes secure behaviour excessively difficult, responsibility cannot simply be placed on the person who eventually makes a mistake.
Marian Cieślarczyk’s concept of security culture offers a useful broader perspective. He describes security culture through three interconnected pillars: a mental and spiritual dimension involving ideas, values and knowledge; an organisational and legal dimension; and a material dimension involving the physical and technological conditions of human activity. Applied to cybersecurity, this means that protection cannot be reduced to awareness training. Knowledge matters, but so do procedures, institutional arrangements and the technologies people are expected to use. This becomes visible in very ordinary practices. Individuals can update devices, use strong and unique authentication, enable multi-factor authentication, maintain backups, question unusual requests and know where to report an incident. These actions matter, but they work best when supported by well-designed services, clear procedures and organisations that do not expect users to compensate continuously for poor security design. The principle of security by design follows this logic. Safe behaviour should not depend entirely on perfect attention or expert knowledge. Systems should be designed so that reasonable mistakes do not immediately produce catastrophic consequences. Security is therefore better understood as a shared property of people, technologies, organisations and institutions than as an individual obligation to remain permanently vigilant.
Traditional thinking about security often begins with prevention: identify a threat and stop it before harm occurs. Prevention remains essential, but it is never sufficient. No individual, organisation or state can eliminate all risks. Equipment fails, human beings make mistakes, extreme events occur, and determined adversaries sometimes overcome even strong defences. This is why the contemporary security debate increasingly emphasises resilience.
Resilience changes the question. Instead of asking only “How do we stop this from happening?”, it also asks “How do we continue to function if it happens?” and “How quickly can we recover afterwards?” In cybersecurity, a backup is a straightforward example. It does not prevent a ransomware attack, but a properly maintained and tested backup may prevent the attack from becoming a long-term loss of data or operational capability. Redundant communications, alternative sources of information, emergency procedures and continuity plans work according to the same principle.
This approach is now visible in European regulation. NIS2 requires relevant organisations to implement proportionate cybersecurity risk-management measures covering incident handling, business continuity, backup management, disaster recovery, supply-chain security, cyber hygiene and authentication, among other areas. The CER Directive applies a parallel logic to critical entities more broadly, requiring measures for prevention, physical protection, response, mitigation and recovery. These frameworks concern organisations rather than personal household preparedness, but the underlying principle is similar: a security system should be able not only to resist disruption but also to cope with its consequences.
At the level of everyday life, resilience entails knowing what to do when an account has been compromised, keeping important documents in more than one secure location, having an alternative means of communication, knowing where to obtain trusted information, or being able to continue basic activities during a temporary disruption. Such preparation does not imply expecting disaster. It recognises that uncertainty is a normal feature of social and technological life.
Security can therefore be understood as a continuing process through which individuals, organisations, societies and states protect important values, recognise and reduce vulnerabilities, manage uncertainty and risk, respond to threats, make use of opportunities, and preserve their capacity to function and develop. Cybersecurity is one contemporary part of that larger process that is increasingly important because the distinction between our digital and non-digital lives is becoming harder to maintain.
Selected literature
Buzan, B., Wæver, O. and de Wilde, J. (1998), Security: A New Framework for Analysis, Lynne Rienner, Boulder.
Cieślarczyk, M. (2010), Kultura bezpieczeństwa i obronności, Siedlce.
Frei, D. (1977), Sicherheit: Grundfragen der Weltpolitik, Kohlhammer, Stuttgart.
Kitler, W. (2011), Bezpieczeństwo narodowe RP. Podstawowe kategorie, uwarunkowania systemu, Akademia Obrony Narodowej, Warszawa.
Koziej, S. (2011), ‘Bezpieczeństwo: istota, podstawowe kategorie i historyczna ewolucja’, Bezpieczeństwo Narodowe, 18, pp. 19–39.
Liedel, K. (2005), Bezpieczeństwo informacyjne w dobie terrorystycznych i innych zagrożeń bezpieczeństwa narodowego, Toruń.
Pawłowski, J. (red.) (2015), Podstawy bezpieczeństwa współczesnego państwa (podmiotu). Implikacje, Warszawa.
Stańczyk, J. (1996), Współczesne pojmowanie bezpieczeństwa, Warszawa.
Szpyra, R. (2012), Bezpieczeństwo militarne państwa, Warszawa.
UNDP (1994), Human Development Report 1994: New Dimensions of Human Security, United Nations Development Programme, New York.
Wolfers, A. (1952), ‘“National Security” as an Ambiguous Symbol’, Political Science Quarterly, 67(4), pp. 481–502.
Zięba, R. (2008), ‘Pozimnowojenny paradygmat bezpieczeństwa międzynarodowego’, w: R. Zięba (ed.), Bezpieczeństwo międzynarodowe po zimnej wojnie, Warszawa.
English: