The Internet Integrity Workshop III examined the abuse of residential proxy networks, which have grown to an estimated 100–200 million exit nodes globally, generating aggregate capacity in the hundreds of terabits per second. These networks — built on compromised consumer devices, supply-chain-implanted malware, and uninformed Software Development Kit (SDK) consents — are increasingly used for AI training and are enabling attacks that range from credential stuffing to nation-state intelligence gathering.

This report summarizes the workshop discussions and identifies five possible longer-term directions for the community that flow directly from the workshop findings. These represent areas where sustained, collective effort — across operational, research, policy, and civil society actors — is needed to produce a durable change.

Cybersecurity is no longer optional—it is fundamental to an Internet that underpins modern economic, social, and civic life. In 2025, threats accelerated in scale and sophistication, fueled by advances in artificial intelligence, persistent weaknesses in core infrastructure, and unequal access to basic protections. Individuals, nonprofits, small businesses, and governments were all expected to operate securely in digital environments they neither control nor fully understand. These realities reinforce a core truth that guides the Global Cyber Alliance: securing the Internet demands collective, coordinated action.

This annual report details how we translated that principle into measurable impact. From equipping individuals with practical tools to recognize scams and strengthen cyber hygiene, to supporting mission-driven organizations with targeted training and partnerships, to improving visibility into malicious activity and expanding the reach of MANRS, our work addresses both everyday risk and systemic vulnerabilities. We invite you to explore the report to see how sustained collaboration, responsible innovation, and practical action are building a more secure and resilient Internet.

The Global Cyber Alliance’s new report, “Salt Typhoon Across the Internet: What AIDE Honeypots Reveal About a Persistent State-Linked Campaign,” uses AIDE data to demonstrate Salt Typhoon’s operational characteristics through observable attack patterns spanning 2+ years.

Salt Typhoon has been publicly attributed to actors based in China and assessed as state-sponsored; AIDE’s findings focus only on behavioral evidence and do not directly attribute the activity to Chinese authorities.

Salt Typhoon is an active, evolving campaign requiring immediate action from infrastructure operators. This report offers defensive measures that provide concrete protection against documented attack vectors.

An overview of all we accomplished in 2024 and introduces new partners, Board members, and Ambassadors, as well as our Global Voices interview series.

Implementing basic cyber hygiene leads to a significant improvement in the ability of small businesses to fend off ransomware, according to this analysis by Tidal Cyber and the Global Cyber Alliance (GCA).

The second issue of the GCA Internet Integrity Papers series presents the results of the second phase of the IoT Policy and Attack research project, conducted jointly by the Global Cyber Alliance (GCA) and Microsoft. Based on real IoT attack data obtained from GCA’s AIDE platform and ProxyPot honeypot technology, the project focuses on providing factual evidence about the applicability and effectiveness of some of the most widespread policies, recommendations, and standards on IoT security. This report has analyzed the role that the IoT devices’ software stacks —and their known vulnerabilities— play as factors to drive targeted attacks.

Based on data about real IoT attacks extracted from GCA’s AIDE platform and ProxyPot infrastructure, the project aims to provide factual evidence on the validity of the most widespread policies, recommendations, and standards on IoT security around the globe. The result of the research strongly suggests that policymakers are correct in emphasizing secured access when turning standards into policy. Strong passwords, vulnerability disclosure policies, and efficient patching should be guiding principles of any baseline strategy for IoT protection.

When DNS is used as a security measure, aka DNS firewall, the benefits can be significant. Our research has shown that DNS firewalls could have mitigated one-third of the incidents we studied and could have prevented $10 billion in losses in those incidents. Download the report to learn more about the economic value of DNS security.