Cybersecurity cannot be ensured through technology, software and government institutions alone. People’s habits, knowledge and ability to recognise digital threats are equally important. Estonia’s experience shows that films, television, theatre, literature, exhibitions and other forms of popular culture can make complex cybersecurity issues more accessible to the wider public.
Cyber risks can be reduced and managed, but they cannot be eliminated completely. Phishing attacks, fraudulent messages, data breaches and other digital threats frequently exploit people’s carelessness or lack of knowledge. A country’s cyber defence capabilities therefore depend not only on professional specialists and advanced technologies, but also on the everyday digital behaviour of its citizens.
Traditional awareness campaigns are often limited to warnings about risks and instructions about what people should avoid doing. Providing information alone, however, is not always enough to change long-term behaviour. People may know that they need secure passwords and should not open suspicious links, yet continue to choose the simplest and most convenient option in practice.
Popular culture can help narrow this gap between knowledge and action. Films, television series, books, theatre productions, exhibitions and music can present cyber threats through recognisable real-life situations, creating an emotional connection with audiences. Although popular culture sometimes exaggerates or dramatises cybersecurity risks, it can also encourage interest in technology, help people remember safe practices and inspire young people to pursue careers in cybersecurity.
From a technical issue to societal security
For many years, cybersecurity was regarded primarily as the responsibility of technical specialists. In a digital society, however, almost every person becomes part of the broader security system. A single successful phishing message, stolen password or careless disclosure of data can have consequences not only for an individual user, but also for a company or public institution.
In Estonia, digital security is increasingly presented as a societal and cultural issue. The country’s approach combines the work of institutions with education, media and public engagement. Cybersecurity messages are incorporated into familiar formats so that good cyber hygiene becomes an everyday habit rather than merely a reaction to a particular incident.
This approach is also supported by initiatives at the European level. The European Union Agency for Cybersecurity, ENISA, coordinates European Cybersecurity Month each year, during which public- and private-sector partners educate society about protecting personal, financial and professional data. Meanwhile, the Tallinn-based NATO Cooperative Cyber Defence Centre of Excellence organises the international CyCon conference, training programmes and other knowledge-sharing activities. Original study
Professional conferences and institutional campaigns, however, primarily reach people who are already interested in technology and security. Simpler and more emotionally engaging formats are needed to reach children, parents and other members of society without a technical background.
Estonia’s cultural advantage
Estonia offers a particularly suitable environment for connecting cybersecurity and culture. The country has maintained strong traditions of reading books and visiting museums, cinemas and theatres. Museums increasingly operate not only as repositories of historical objects, but also as educational and community centres offering classes, exhibitions, virtual tours and other interactive formats.
Libraries have also been used as local centres of cybersecurity knowledge. During campaigns focused on public digital safety, library employees were trained in browser security, fraud detection and password management. This allowed residents to receive practical assistance in a familiar and trusted setting.
This experience shows that cybersecurity information does not need to reach society exclusively through technology companies or government institutions. Libraries, schools, theatres, museums, television producers and artists can all become partners in implementing national cybersecurity policy.
Exhibitions encourage reflection on personal data
One of Estonia’s most prominent examples is artist Timo Toots’ interactive installation “Memopol”. It used a visitor’s identification card, information from national databases and mobile phone data to create a personalised data visualisation.
The installation demonstrated how much information about an individual is stored across different digital systems and how separate pieces of data can be combined to create a highly detailed personal profile. This kind of experience allows visitors to understand data protection in a far more personal way than they would by reading a general warning.
Glass artist Rait Prääts’ exhibition “Chip Crisis”, meanwhile, explored the relationship between technology, artificial intelligence, augmented reality and the natural human environment. It encouraged reflection not only on the opportunities offered by technology, but also on questions of truth, ethics, hybrid warfare and society’s growing dependence on digital systems.
Theatre as a space for cybersecurity education
Theatre can be an especially effective format for reaching young people. The Estonian youth production “Born on the Net” was created using real accounts from young people about situations they had experienced online. Estonia’s Cybercrime Bureau and the Estonian Union for Child Welfare were also involved in developing the production.
The situations portrayed in the play helped young people understand how closely events in the virtual world are connected to real life. It examined both the opportunities offered by the internet and the risks young people may encounter in digital environments.
The production was primarily intended for young people aged between 12 and 16, but its content was also relevant to parents and teachers. It was performed 32 times in different parts of Estonia over several months and reached an audience of approximately 11,000 people. This level of interest demonstrated that theatre can provide an appropriate environment for discussing digital threats and safe online behaviour. Full study and analysis of the examples
Television must find the right balance
Cybersecurity themes have also appeared in Estonian television content. The educational comedy series “IT-planet” explained computer and security issues in an entertaining format. At the end of each episode, viewers received practical advice about how they should or should not behave online.
The project nevertheless revealed one of the main risks associated with this approach. When an educational message is delivered too directly or becomes overly moralising, it can weaken the story itself and reduce the audience’s interest. Cybersecurity content must be factually accurate, but it must also work professionally as a film, television series or other cultural product.
Government institutions must therefore be able to trust creative professionals. If every scene is required to carry an official instruction, the result may lose its emotional power. A compelling story, by contrast, can influence attitudes more subtly and for much longer than a one-off advertising campaign.
Popular culture cannot replace education
Films, exhibitions and theatre productions can attract attention, stimulate interest and help people remember cybersecurity principles. Cultural activities alone, however, are not enough. A gap remains between awareness of risks and actual behavioural change.
A person may understand that phishing is dangerous but still not know how to verify a link, activate multi-factor authentication or manage passwords securely. Popular culture must therefore be supported by practical training, accessible security tools and systematic digital education in schools and workplaces.
Estonia’s experience shows that culture can become an important part of society’s cybersecurity infrastructure. It can translate complex and abstract threats into stories that people understand, connect digital security with everyday life and reach audiences that traditional institutional campaigns often fail to engage.
For this approach to be effective, systematic cooperation is required between cybersecurity specialists, government institutions, schools, researchers, media organisations and the creative industries. Popular culture cannot replace professional cyber defence, but it can help build a society in which people understand digital risks more clearly and behave more responsibly in their daily lives.
Author: Kate-Riin Kont, researcher at the Internal Security Institute of the Estonian Academy of Security Sciences.
Original source: Kate-Riin Kont, “The Importance of Pop Culture and Media in Increasing Citizens’ Cyber Defense Capacity: The Case of Estonia”, Information & Media, Vilnius University Press, Vol. 104 (2026), pp. 38–54.
Licence: Creative Commons Attribution 4.0 International (CC BY 4.0).
This article has been shortened, restructured and editorially adapted for publication on BalticNews.com. The complete original text, citations and reference list are available in the original publication.
