Timon, to start with: what do we mean by knowledge security?

Essentially, it is about preventing knowledge developed in the Netherlands from ultimately compromising our security.

This can happen in various ways, which should be prevented through good knowledge security policies. One example is unwanted knowledge transfer. Just as an innovative company protects its patents, science ensures that its most sensitive knowledge does not inadvertently fall into the wrong hands or get abused by other countries for military purposes. Another aspect is covert influence. This involves state actors influencing and pressuring scientists in the Netherlands, preventing them from freely conducting their research.

If Dutch science is too naive in this regard, there is a risk that people elsewhere in the world may be oppressed or harmed by knowledge developed in the Netherlands. For example, facial recognition software developed to track criminals but used elsewhere to track dissidents of a foreign regime, thereby suppressing democracy.

Knowledge security seems to have quickly risen on the agenda in recent years. Where does this come from?

This is all related to the world around us. Due to increased geopolitical tensions, the focus on science has changed. Governments and institutions now see that knowledge and technology (such as AI, chips, or biotech) are also strategic tools. The big question is: how do you remain an open, international knowledge country without being naive about the risks? This urgency is now felt everywhere.

How do you view this?

I mainly see how rapidly things have progressed. While knowledge security was initially something new or even abstract for many institutions, almost all institutions now have their affairs in order with their own policies and processes. There are still institutions without policies, but they have consciously decided that they do not need them because, for example, they hardly collaborate internationally.

This has clearly had an effect: institutions recognise risks better and are better able to limit them themselves. In this sense, knowledge security has quickly matured. A few years ago, institutions and scientists viewed knowledge security as a threat to open science. Now we see a shift: knowledge security is increasingly seen as a precondition to protect open science. That is quite a significant change.

How has government policy helped with this?

In the initial phase, the role of the government was crucial. A model focusing on awareness and the individual responsibility of institutions was deliberately chosen. The Knowledge Security Desk has worked well in this regard: by providing information, answering questions, and bringing institutions together in a learning community, knowledge security has not only become more widely known but has also deepened within the sector.

At the same time, we see that this success in 2026 has led to a new situation: institutions have become more mature themselves and now have different support needs.

So, what are the changing needs?

Institutions are less interested in general information and more in need of specialised expertise that they do not possess. They seek a sparring partner who can, for instance, help determine if a technology falls under complex legislation or identify risks within a specific collaboration.

The Knowledge Security Desk could be this sparring partner, but it would require more resources, knowledge, and mandate than it currently has.

What are the main practical challenges institutions are facing now?

I see three recurring dilemmas:

• Open or closed? The balance between open science and protection of sensitive research. The motto "open where possible, closed when necessary" is still relevant but sometimes difficult to determine in practice.
• Customisation or fixed rules? The quest for an optimal balance between a time-consuming case-by-case risk assessment with the potential for arbitrariness and an efficient guideline that may be overly general.
• Preventing exclusion. Preventing discrimination and stigmatisation. Knowledge security deals with risks in a collaboration, not where someone comes from, but the focus understandably tends to be on a few high-risk countries. This can lead to stigmatisation of people from those countries.

What does this mean for the coming years?

We are clearly in a new phase. The initial years focused on building awareness and establishing policies. That phase is largely completed. The next step requires more targeted support that aligns with different types of risks and institutions. The core remains the same: knowledge security is not about choosing between openness and security, but about carefully combining both.