CyberPeace Tracer Shares Email Threat Data to Help NGOs Spot Phishing

For organizations with limited security staff, a phishing attempt at one nonprofit can be an early warning for others. The CyberPeace Tracer turns data gathered across a network of NGOs into shared views of email threats, vulnerabilities and malware activity. Its practical value lies in making incidents more visible across a sector where attacks can go unreported and organizations may not know they have been targeted.

The project brings together the CyberPeace Institute and Cloudflare. The Institute enrolls NGOs in Cloudflare Email Security and acts as a central point for collecting real-time threat data. The resulting dashboards let other organizations examine patterns in malicious email, including common subject lines and threats blocked by the service. That gives security teams information they can use to review their own exposure and defenses.

Why shared visibility matters

Nonprofits and other civil society organizations deliver services in areas such as health, humanitarian relief and human rights. Their work can make them targets for attackers seeking sensitive information or trying to interrupt operations. Cloudflare says organizations protected through its Project Galileo program experience an average of 95 million attacks per day in aggregate. That figure describes attacks across the protected organizations collectively; it is not a count for each organization.

Many nonprofits also have limited resources for monitoring and response. An organization might lack the tools or staff to identify a phishing attempt quickly, and a successful compromise may not become apparent until later. When incidents are missed or disclosed only after a delay, each organization has less information to recognize similar activity elsewhere.

The CyberPeace Institute’s centralized onboarding model is designed to make those observations more useful across its network. It can analyze flagged emails and help identify malicious domains and ongoing threats. When one participating NGO encounters a suspicious message, the resulting analysis may help other organizations recognize related activity before it reaches them. The approach depends on the quality and scope of the data partners can collect, but it offers a way to share insights without requiring every small organization to build its own threat monitoring operation.

What the Tracer shows

Developed by the CyberPeace Institute, the CyberPeace Tracer collects and analyzes information about cyberattacks and disinformation targeting NGOs, nonprofits and charities working on global social challenges. Its stated aim is to show the scale and effects of these threats, help organizations identify emerging risks and support better defensive decisions.

Partners monitor a predefined set of NGO domains and contribute data to the Tracer. Its dashboards cover publicly disclosed software and hardware vulnerabilities that could affect monitored organizations, detected malware infections, and phishing analysis that surfaces trends and attacker tactics. Users can examine incidents by sector, including health, development, food, water, energy, human rights and women’s rights.

The phishing dashboard includes filters by country, a list of subject lines received by NGOs, and the five leading threats blocked by Cloudflare Email Security. These views can help teams see which lures are appearing in the monitored data and compare them with messages arriving in their own inboxes. They describe activity in the participating network, so readers should treat them as shared monitoring data rather than a complete record of every attack against NGOs.

Email protection and participation

Cloudflare Email Security is designed to detect and block malicious email, including phishing and ransomware attempts. The source describes deployment as requiring no additional hardware or software. The CyberPeace Institute tested the service and saw potential to extend it to smaller organizations that may not have comparable security tools or budgets. In the collaboration, the Institute handles onboarding for its NGO network, while the aggregated data supports the Tracer’s views of email threats.

The Institute is an independent nonprofit based in Switzerland. Its work includes partnerships and data-driven analysis of cyber incidents and their effects on people. Cloudflare’s relationship with the Institute began in 2022, when it joined Project Galileo. Through that program, Cloudflare protects the Institute’s website and provides Zero Trust tools for securing staff access to internal applications. The Institute also helps Cloudflare identify organizations that may need protection through Galileo, alongside more than 53 other civil society organizations.

The Tracer’s usefulness will depend on continued participation and on how well its monitored domains represent the wider nonprofit community. Still, its shared dashboards give smaller organizations a practical starting point: they can see patterns reported across the network and use them to inform their own security work. NGOs interested in Cloudflare Email Security can find details through the CyberPeace Institute’s Cloudflare page; organizations seeking protection through Project Galileo can apply at Cloudflare’s Galileo page.