Epistemic authority in international security law: nuclear security and cyber operations

Why do states follow international security norms that they have never formally consented to? In international security law, particularly in fields such as nuclear security and cyber operations, detailed standards shape state behaviour despite not being embodied in treaties or negotiated through classical diplomatic channels. This article argues that the central transformation is not simply the rise of soft law, but a shift in the basis of normative authority, from state consent to epistemic authority. When political agreement on new binding rules becomes difficult, expert and technical bodies generate standards that functionally structure state conduct. These norms gain traction through technical credibility, institutional embedding, and practical usability rather than formal consent. The argument is developed through two case studies. In the nuclear field, International Atomic Energy Agency security standards progressively inform treaty obligations and domestic regulation, operating as the benchmark for compliance. In the cyber field, where treaty-making has largely stalled, the Tallinn Manuals produced by the North Atlantic Treaty Organization (NATO) Cooperative Cyber Defence Centre of Excellence have become key reference points for the application of international law in cyberspace. The comparison shows how epistemic authority can functionally substitute consent as an engine of norm creation in contemporary international security governance.