The milestone, in numbers
On September 30, 2026, Cloudflare announced that its Impact programs will reach $100 million in donated services this week. The programs protect journalism outlets, civil society groups, state and local governments, election bodies, and public schools from cyberattacks.
The scale is worth pausing on. Project Galileo, launched in 2014, now covers more than 3,500 domains in over 120 countries. In 2025 alone, Cloudflare reports blocking 38.5 billion attacks against those participants — about 105.4 million per day. The Athenian Project protects 440+ election websites across 33 U.S. states, expanded to eight countries. Cloudflare for Campaigns covers 530+ campaign sites.
Why the free tier was never charity
The part I find most instructive for builders is the origin story. Cloudflare started as a free service whose attack data fed paid products. They then noticed free customers doing essential work — reporting on corruption, covering the invasion of Crimea — were absorbing some of the largest attacks on the network.
That observation turned a growth tactic into a business pillar. Their own framing is blunt: the Impact programs were never philanthropy; they are part of the business and mission. For anyone designing a free tier, that’s the pattern worth studying — the free users who stress your infrastructure hardest may also be the ones whose protection defines your reputation.
The demand side is worse than average
Cloudflare’s first annual report on attacks against civil society, released in 2026, found these organizations are targeted more frequently and more intensely than typical customers. Project Galileo participants faced website vulnerability exploitation attempts at more than seven times the rate of an average user. Applications to the program are on pace to more than double year over year.
If you build security tooling, that’s a market signal about an underserved segment — and a reminder that attack volume is not evenly distributed across your customer base.
From defense to AI-era enablement
The programs are expanding beyond firewalls. Free Bot Management and AI Crawl Control now go to over 750 journalists and news organizations, giving them control over how AI crawlers access their content. The startup program — $250,000 in credits — opened to non-profits for the first time, with the first 30 organizations announced this week. Cloudflare engineers also built automation tools for three human rights organizations.
A concrete example: at a September 9, 2026 hackathon in Barcelona co-hosted with Media Party, the winning team AIdas built a tool comparing how different LLMs answer politically contested questions, publishing responses as open data. The themes — workflow automation, agentic journalism, synthetic-content verification, information integrity — read like a roadmap for what newsrooms actually need next.
This shift from “protect them” to “equip them” echoes what I noted when Cloudflare gave every agent branch its own runtime: the developer platform keeps becoming the delivery mechanism for the company’s public-interest work, not just its commercial one.
The takeaway
A hundred million dollars in donated services started as a data-collection strategy for a free product. If you’re deciding what your free tier is for, Cloudflare’s example suggests asking a sharper question than “what will drive conversions”: which users, if attacked or squeezed out, would define what your product stands for — and what would it cost to protect them?
One caveat: these are Cloudflare’s own figures and framing from its anniversary announcement, not an independent audit of impact.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.