Cloudflare's Impact programs will pass $100 million in donated services this week, a milestone that has put security in front of thousands of organizations — journalism outlets, civil society groups, state and local governments, election management bodies, and public schools among them. The company frames the programs as a core part of its business and mission rather than philanthropy, and as a force that continues to shape its direction.

From a free tier to a security program

Cloudflare began as a free service. The plan was to offer a basic version to developers and small businesses, then use attack data from their sites to build products worth selling. That changed once the company saw that some free customers were doing essential work — reporting on corruption in Africa, covering the Russian invasion of Crimea — while absorbing some of the largest attacks on the network. Cloudflare committed to keeping the services free and to doing more for organizations targeted by powerful adversaries for serving the public.

Project Galileo launched in 2014 to extend more advanced security to vulnerable but important people and groups online, including journalists, human rights defenders, and civil society organizations. It now covers more than 3,500 domains across over 120 countries. In 2025, Cloudflare blocked more than 38.5 billion attacks against Project Galileo participants — DDoS, website vulnerability exploits, email phishing, and others — close to 105.4 million per day.

Later programs follow the same principle: support public-serving institutions, especially those without ready access to cybersecurity services.

  • Athenian Project (2017): protects state and local governments running democratic elections, covering more than 440 websites in 33 U.S. states. It has since expanded beyond the U.S. to election management bodies in eight countries, among them Canada, North Macedonia, Georgia, and Moldova.
  • Cloudflare for Campaigns (2020): runs with Defending Digital Campaigns to give candidates for public office free cybersecurity services, now spanning more than 530 websites across the United States.
  • Critical infrastructure: additional efforts extend protection to public schools, COVID-19 response efforts, the government of Ukraine, public health clinics, community networks, and other essential services.

Attack data and AI-era adaptation

Keeping these organizations online and their internal data protected remains the foundation. In 2026, Cloudflare released its first annual report on cyberattacks against civil society, finding that civil society organizations are targeted more often and more intensely than other Cloudflare customers. Project Galileo participants, for instance, faced attempts to exploit website security vulnerabilities at a rate more than seven times that of an average user. Applications to the program are on pace to more than double last year's total.

Breakdown of website vulnerability exploit attempts against Project Galileo participants by organization type. Source: 2026 Cloudflare report on cyberattacks against civil society

The programs have also shifted toward helping public interest groups adapt to AI, not just defend themselves against attacks. In early September 2026, Cloudflare co-hosted a hackathon in Barcelona — an event specifically for journalists rather than the usual crowd of software engineers and startup founders.

Media Party hackathon co-hosted by Cloudflare at the BIT Habitat in Barcelona (September 9, 2026).

It was part of a three-day conference held by Media Party, a nonprofit focused on media innovation through digital tools. The event brought journalists, developers, and strategists together around one question: how newsrooms adapt to an AI-driven, post-search information landscape. Four themes guided the sprint — workflow automation, agentic journalism, synthetic-content verification, and information integrity.

Teams got free access to Cloudflare's developer platform plus volunteer engineers from the company to see what they could build in a day. Four reached the final round. The winner, AIdas, built a tool for studying AI bias across politically contested topics by comparing how different LLMs answer the same question and recording the responses as open data.

AIdas compares bias among AI models on politically contested topics and records them as public data.

Further efforts extend the same idea:

  • AI crawler control for local news: Project Galileo participants — including more than 750 journalists, independent news organizations, and non-profits supporting news-gathering — received free access to Cloudflare's Bot Management and AI Crawl Control, so they can see and control how AI crawlers reach their content and shield reporting from unauthorized scraping.
  • Non-profit startups: the startup program, which offers more than $250,000 in Cloudflare credits, opened to non-profit organizations last year; the first 30 accepted organizations and the tools they have built on the developer platform will be announced this week.
  • Automation tools for human rights: three projects built by Cloudflare engineers on the developer platform for three leading human rights organizations — covering tracking of transnational repression, digital rights legislation and policy development, and corporate human rights due diligence — will also be announced this week.

The goal across all of it stays the same: give organizations doing essential work the tools and support to keep advancing their missions.

Cloudflare engineers who volunteered at the Barcelona hackathon said one reason they joined the company was Project Galileo and the chance to apply their skills for organizations in their own communities — a reminder, the company says, that the Impact programs continue to shape its identity and the people who choose to work there.