Abstract
<title>Abstract</title> <p> The governance of cyber security infrastructures increasingly depends on how decision-makers conceptualise their roles and responsibilities within complex threat data-sharing ecosystems. Drawing on two years of qualitative field work that integrated action research and co-design among public and private sector cyber security stakeholders in India, this paper explores how the emergence of cognitive-linguistic prototypes – the firefighter, the smoke-detector, the bystander, and the <italic>Danda</italic> – shapes organisational behaviour and policy reasoning. Using a disinformation pilot as a methodological stress-test, we demonstrate how these metaphorical frames produce distinct biases in the development, standardisation, and adoption of Cyber Threat Intelligence (CTI) platforms. We show that such socio-cognitive framing contributes to inertia in platform development, fragmented coordination, and constrained innovation in national cyber security infrastructures. By linking cognitive-linguistic prototypicality with the material politics of CTI platformisation, the paper also highlights how mental models of governance influence the evolution of data-driven cyber security ecosystems in emerging economies such as India. </p>