Background

In 2023, over 880,000 cyber crimes in the U.S. resulted in around $12.5 billion in losses, according to the FBI’s Internet Crimes Complaint Report.¹ Ransomware attacks alone directly impacted at least 2,200 hospitals, schools, and governments across the U.S. that year.² Those estimates almost certainly undercount the problem’s scope because it is likely that a number of cybersecurity incidents go unreported. In addition to financially motivated crimes, politically motivated cyber attacks also represent significant concerns. In early 2024, the Cybersecurity and Infrastructure Security Agency (CISA) reported that a foreign state-sponsored cyber actor was discovered to have maintained access to critical infrastructure systems across the U.S., in some cases, for as long as five years.³

While the cyber threat landscape continues to evolve rapidly, the number of cybersecurity professionals needed to defend against those threats has not kept pace. In mid-2024, cybersecurity job openings numbered around 470,000.⁴ By one estimate, the U.S. would need to train 40 percent of all people entering the workforce in cybersecurity over the next seven years to meet the growing cyber workforce gap.⁵ However, efforts to increase the size of the cybersecurity workforce, even if successful, are unlikely to be sufficient to meet that goal. In a 2023 congressional hearing, Representative Mike Gallagher (R-W.I.) remarked, “Since 2013… we have tried to address the civilian and military cyber workforce dilemma 45 times… And the country’s collective capabilities and readiness are, seemingly, no better off because of it.”⁶ In addition to the cybersecurity workforce shortage, software developers continue to develop insecure software, increasing the burden and potential vulnerability of under-resourced organizations who utilize the software.⁷ In 2023, nearly 29,000 common vulnerabilities and exploits (CVEs), which are weaknesses in software that can be exploited, were recorded.⁸

“By one estimate, the U.S. would need to train 40 percent of all people entering the workforce in cybersecurity over the next seven years to meet the growing cyber workforce gap.”

In the United States, those under-resourced organizations are often state, local, tribal, and territorial governments (SLTTs) and small- and medium-sized businesses (SMBs), which operate much of the country’s critical infrastructure and provide many essential services. For example, according to CISA, there are “approximately 153,000 public drinking water systems and more than 16,000 publicly owned wastewater treatment systems in the United States.”⁹ SLTTs and SMBs must navigate the same cyber threat landscape as the federal government and global corporations, but with far fewer resources.¹⁰ According to a 2023 report from NetDiligence, the average cost of cyber incidents for SMBs in the five years leading up to 2023 (excluding business interruption and certain other costs) was over $1 million.¹¹

Examples from recent years highlight the total costs of cybersecurity incidents. For instance, a 2018 ransomware attack on the City of Atlanta, Georgia, resulted in costs estimated to be around $17 million.¹² A 2019 ransomware attack on the City of Baltimore, Maryland, cost taxpayers over $18 million,¹³ and a 2022 ransomware attack on Suffolk County, New York, resulted in costs estimated as high as $25 million.¹⁴ More recently, a 2023 ransomware attack on Dallas County, Texas, resulted in around $8.6 million in costs for recovery efforts, including the purchase and installation of new devices and equipment; temporary staff; credit monitoring and identity theft protection services; call center support; forensic accounting; application and system recovery; and software licenses.¹⁵

In the private sector, according to one survey, 60 percent of companies go out of business within six months of a significant cyber attack.¹⁶ The same study notes that 30 percent of SMBs do not have a written information security incident response plan; 21 percent of SMBs do not have backup copies of data sufficient to restore systems following a cyber attack; and only 28 percent would survive beyond seven days after a ransomware attack taking their operations offline.¹⁷

To date, the U.S. has not taken adequate measures to defend SLTTs and SMBs against cyber attacks. However, a cyber volunteer ecosystem is emerging to fill the gap. In some states, universities have established cybersecurity clinics where professors and students work to improve the cyber resiliency of SLTTs and SMBs and train the next generation of cybersecurity professionals.¹⁸ Across the U.S., nonprofit organizations, like the Cyber Peace Institute and, recently, DEFCON’s Project Franklin, have created opportunities for cybersecurity professionals to volunteer to assist beneficiaries with cybersecurity needs.¹⁹

Government entities have also taken action. At the federal level, the U.S. Marine Corps established a Cyber Auxiliary to provide education and training to the Marine Corps. Meanwhile, state governments have established volunteer civilian cyber corps (C3s) to improve the resiliency of SLTT entities within their borders. Maryland, Michigan, Wisconsin, Ohio, and Texas have formed C3s to provide cybersecurity services to beneficiaries. Other states are considering this option as a replicable and scalable solution to help address cyber workforce challenges, improve cyber resiliency, and develop cyber emergency response capabilities accessible to local entities. Outside the United States, countries such as Estonia, Sweden, Switzerland, and others already take a whole-of-society approach to cybersecurity and utilize civilian cyber volunteers.