We're not from the government, but we're here to help them help you

The session, given by two speakers from volunteer cyber defense programs, explains how civilian experts can support public bodies and nonprofits that lack dedicated security staff. The first speaker described a Michigan volunteer corps formed with state backing in the early 2010s. Many of the state's public entities have little or no IT support, and a statewide exercise exposed gaps in coordinated response. The group explained its selection path, which includes skills tests, background checks, and agreements with both the volunteer and the volunteer's employer. Members train together and respond only when a victim formally requests help, with state police and a cyber command unit handling the legal side.

The second speaker, from a Geneva-based nonprofit, outlined the growing targeting of humanitarian organizations, where attacks have diverted funds and exposed personal data of vulnerable people. Its Cyber Peace Builders program pairs security professionals with short, mostly remote missions for these groups, ranging from code reviews to one-hour assessments. Volunteers do not all need technical roles, and the work is mostly before or after an incident rather than during one.

The main takeaway is that people respond to reassurance as much as to facts, so outreach should be human and local. Organizations can encourage staff to volunteer through formal employer agreements, and the panel closed by discussing how independent volunteer groups could link up across regions.