2025 marks a pivotal moment for global cyber diplomacy, and a potential transition phase for the second half of this decade. The UN’s first dedicated cybercrime treaty, the UN Cybercrime Convention, opens for signature, setting a precedent for binding multilateral treaty-making on global cybersecurity and digital issues. At the same time, the geopolitical landscape is shifting: the return of a more diplomatically transactional U.S. administration, increased securitisation of cyberspace, and renewed major-power competition extending to grey zone tactics are reshaping the institutional terrain.

This paper explores the evolving landscape of cyber governance by examining the tension between multilateral institutions and emerging plurilateral or issue-specific coalitions. From the UN OEWG and potential Programme of Action, to the Pall Mall process on use of commercial cyber intrusion capabilities, and the high-level global AI summits; multiple overlapping - and at times conflicting - forums are shaping the rules of cyberspace. The paper argues that a dual-track architecture is emerging: one rooted in universal but slow-moving multilateralism, and the other in faster, interest-driven norm clubs.

By analysing how these two tracks interact with reference to recent treaty processes, soft law efforts, and political coordination, the paper highlights key lessons for the next generation of cyber diplomacy and global AI governance discussions. Rather than a binary choice between inclusivity and agility, future institutional design will likely need to recognise and manage this evolving hybrid model.

Ultimately, 2025 may not bring consolidation, but rather codify a bifurcated future for cyber governance, one that reflects broader shifts in the global order. Understanding this emerging dynamic is essential for diplomats, policymakers, and civil society actors navigating the next phase of international digital rule-making, while learning from and building on what has come in the first part of this decade.