Why a sustainable finance mechanism for cybersecurity is key to securing the global economy

Imagine a world in which every small business can access an expert cyber volunteer to defend against artificial intelligence (AI)-enabled cybercrime.

In this world, nongovernmental organizations (NGOs) are notified of botnet activity in time to prevent ransomware attacks, and international aid organizations routinely earmark digital security allocations for their beneficiaries, whether to protect health management systems powering disease eradication or to bake operational technology security into new wastewater infrastructure.

The standards, policy frameworks, and technology needed to achieve this vision largely exist. What is missing is funding.

We estimate that private and corporate philanthropy together contribute $100-$200 million annually to cybersecurity-specific causes. Recently, government grant programmes – notably the State and Local Cybersecurity Grants Program in the US, the UK Integrated Security Fund, and the EU’s Digital Europe Programme – have begun contributing hundreds of millions annually in their respective jurisdictions, but little of this funding is directed towards emerging economies and least-developed countries.

For comparison, the $100-$200 million allocated to cybersecurity philanthropy is a rounding error against the estimated $885 billion given to general charitable causes in 2023, or the $580 billion that flooded into corporate AI investment in 2025.

We are rapidly scaling AI engines without funding the digital brakes. A small fraction of this funding would be enough to create a meaningful sustainable cybersecurity finance mechanism (SCFM) dedicated to making the internet safe and secure for all.

The SCFM would not operate as a single fund, but rather as a coordinated ecosystem of diverse funding sources including individual philanthropy, corporate giving, multilateral funds, and pooled mechanisms aligned under shared principles and scope.

As such, the SCFM would provide a stable funding base to unlock additional resources and fill the gap in funding for under-resourced but critical internet functions. However, as it cannot support every beneficial digital safety service or activity, we suggest narrowing its strategic focus across five parameters to maximize impact:

To ensure optimal outcomes, the mechanism must adhere to three operational principles that empower the organizations delivering critical frontline services.

First of all, infrastructure needs to be prioritized over specificity. Funding should prioritize broad capabilities and core infrastructure rather than being restricted to narrow, programme-specific silos, granting organizations the operational flexibility to pivot against evolving threats.

Secondly, the mechanism needs to ensure consistency and longevity. To foster organizational stability, the SCFM will prioritize predictable, long-term allocations over large, volatile, one-time grants, while streamlining fragmented reporting structures.

The third operational principle is mixed funding models. The SCFM would legitimize mixed funding models, including allowing beneficiary organizations to implement cost recovery from capable users such as law enforcement agencies, while subsidizing users who cannot pay.

Capital does not flow to problems it cannot price. For as long as cybersecurity is treated as a discretionary cost rather than a quantified systemic risk, the funding architecture for cyber as a global public good will remain donor-dependent, fragmented and vulnerable to political cycles. The SCFM should introduce economic legibility through five core pillars:

“Capital flows toward problems that demonstrate economic inevitability and material impact. For cyber: what is the material economic unlock? What economic problem does solving cyber resilience address? Impact must link to economic value,” says Fleur Heyns, CEO of Proof of Impact.

As governments and financial institutions explore new sustainable finance mechanisms for cybersecurity, Brazil is emerging as an example of innovation in cyber resilience funding for small and medium-sized enterprises (SMEs).

Through its Institutional Security Office of the Presidency of the Republic (GSI/PR) aligned with the National Cybersecurity Strategy (E-Ciber), Brazil is partnering with the Inter-American Development Bank, National Bank for Economic and Social Development (BNDES) and other institutions to create a subsidized credit model that combines financing with technical support, training, compliance assistance, maturity assessments and post-incident recovery.

The initiative reframes cybersecurity as an economic resilience issue rather than an IT cost. By improving SME access to affordable cyber resources, Brazil aims to reduce systemic cyber risk, strengthen supply chains, and improve the resilience of a sector that represents a major share of national employment and gross domestic product.

Through the Hackers do Bem (Good Hackers) initiative, the programme also offers training and free technical assistance while providing an employment opportunity for youth.

The internet connects over two-thirds of the world’s population, serving as the foundational terrain for AI and emerging technologies. Its integrity deeply affects national security, economic prosperity, and public health and safety.

A sustainable, impactful, and transparent finance mechanism for cybersecurity is the baseline requirement to secure the technical infrastructure of our global economy and protect under-resourced organizations and people.

It is time to establish a sustainable cybersecurity finance mechanism if we are to realize the full upside of technological advances and make our digital public space safe and secure for all.

Authors of this blog were Global Future Council on Cybersecurity members Anna Maria Collard, SVP, Content Strategy & CISO Advisor Africa, KnowBe4; Ann Cleaveland, Executive Director, Center for Long-Term Cybersecurity, UC Berkeley; Hoda Al Khzaimi, Associate Vice-Provost for Research Translation and Entrepreneurship, New York University Abu Dhabi; Jamie Saunders, Oxford Martin Fellow,University of Oxford; Michael Daniel, President and Chief Executive Officer, Cyber Threat Alliance; and Sameer Suryakant Patil, Director, Centre for Security, Strategy and Technology, Observer Research Foundation (ORF).