Playing the Market Card: The Commission's Strategy to Shape EU Cybersecurity Policy

As EU security is an intergovernmental policy area, it has been assumed that the only relevant policy‐shapers are member states. However, more recent analyses show that supranational actors, like the Commission, have developed strategies to enhance their role in this traditionally interstate realm. This article endorses this reasoning and intends to cast some light on these strategies. Building on Kingdon's concept of the policy entrepreneur and using EU's cybersecurity policy as an empirical case, we analyse the Commission's initiatives to draft a European response to cybercrime, in order to answer one central research question: how has the Commission managed to secure a prominent role in a highly salient security issue? The findings suggest that the Commission, acting as a policy entrepreneur, purposefully explored a market–security nexus in order to influence an otherwise intergovernmental security domain. Ultimately, the Commission was a much more relevant player than expected.