Who Coordinates U.S. Cyber Defense? A Co-Authorship Network Analysis of Joint Cybersecurity Advisories (2024--2025)

TL;DR

This study analyzes the organizational structure of U.S. and allied cybersecurity collaboration through a co-authorship network of joint advisories, revealing key agencies and their roles in coordination and influence.

Contribution

It introduces the first replicable dataset and network analysis of joint cybersecurity advisories, highlighting agency roles and collaboration patterns.

Findings

CISA and FBI are central coordination hubs.

NSA, NCSC, and ASD-ACSC serve as key bridges.

The U.S. triad and Five Eyes form a dense collaborative network.

Abstract

Cyber threats increasingly demand joint responses, yet the organizational dynamics behind multi-agency cybersecurity collaboration remain poorly understood. Understanding who leads, who bridges, and how agencies coordinate is critical for strengthening both U.S. homeland security and allied defense efforts. In this study, we construct a co-authorship network from nine Joint Cybersecurity Advisories (CSAs) issued between November 2024 and August 2025. We map 41 agencies and 442 co-authoring ties to analyze the structure of collaboration. We find a tightly knit U.S. triad -- CISA, FBI, and NSA -- densely connected with Five Eyes and select European allies. Degree centrality identifies CISA and FBI as coordination hubs, while betweenness highlights NSA, the UK's NCSC, and Australia's ASD-ACSC as key bridges linking otherwise fragmented clusters. By releasing the first replicable dataset and network analysis of CSAs, we provide new empirical evidence on how collaborative cybersecurity signals are organized and where strategic influence is concentrated.