Global Cyber Security Capacity Centre (GCSCC), University of Oxford

What Global Cyber Security Capacity Centre (GCSCC), University of Oxford does

The Global Cyber Security Capacity Centre (GCSCC) is an academic research centre within the Department of Computer Science at the University of Oxford, founded in 2013/2014 to study what works and what does not work in cybersecurity capacity building. Its flagship offering is the Cybersecurity Maturity Model for Nations (CMM), a five-dimension assessment framework (policy and strategy; culture and society; knowledge and capabilities; legal and regulatory frameworks; standards and technologies) used to benchmark national cybersecurity capacity, deployed through collaborative reviews with national governments. The CMM has been used in over 90 countries, and complementary frameworks include the National AI Cybersecurity Readiness Metric (for AI-specific risk preparedness), the Cyber Resilience Compass (organisational cyber resilience), and the Cyber Harm Framework (measuring harms from cyber incidents). Products are delivered via direct government engagements, the Global Constellation regional partner network, partnerships with international organisations (World Economic Forum, OAS, World Bank, GFCE, UK FCDO, JICA), and public dissemination through the Cybil Knowledge Portal and research publications.

The centre is funded primarily through grants and partnerships with bilateral and multilateral development organisations rather than fee-based commercial revenue; pricing is not publicly disclosed. Its customer base is concentrated entirely in national governments and international institutions. The team of approximately nine core staff is led by Director Professor Sadie Creese and Co-Director Professor Michael Goldsmith, with senior research staff conducting both capacity-building fieldwork and AI cybersecurity policy research. Recent activity (2025–2026) shows an expansion into AI cybersecurity — including the AI Readiness Metric, AI supply chain publications, and conferences on AI and cyber resilience — alongside continued CMM deployment in new geographies such as Mexico, Mongolia, Kuwait, Costa Rica, and South Africa.

Name

Global Cyber Security Capacity Centre (GCSCC), University of Oxford

Legal name

Global Cyber Security Capacity Centre (GCSCC), University of Oxford

Website

https://gcscc.ox.ac.uk

Company type

Private

Founded year

2014

Operating status

Operating

Headcount range

1–10 employees

Short description

The Global Cyber Security Capacity Centre (GCSCC) at the University of Oxford is an academic research centre that develops frameworks — notably the Cybersecurity Maturity Model for Nations (CMM) and the AI Cybersecurity Readiness Metric — to assess and benchmark national cybersecurity capacity, serving over 90 governments and international organisations through grants and partnerships.

Ownership category

akta.pro rank

Product category

Cybersecurity Capacity Building Research

NAICS

Computer Systems Design and Related Services (5415)

SIC

Services-Management Services (8741)

akta.pro primary industry

Governance, Risk & Compliance (GRC) Advisory & Assessments (BPAKAHAH)

akta.pro secondary industries

Governance, Risk & Compliance (GRC) Platforms (BPAEAPAA), Privacy, Data Protection & Cyber Governance (GRC) (BPAHAFAF), Regulatory Change Management (RCM) (HDADAIAG)

Keywords

• Cybersecurity capacity building
• National cybersecurity maturity assessment
• CMM framework deployment
• AI cybersecurity readiness
• Cyber resilience research

Headquarters

HQ city

Oxford

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Others

Distribution channels4 records

Marketing channels6 records

Core offering

The GCSCC is an academic research center at the University of Oxford that develops frameworks and conducts national-level assessments of cybersecurity capacity. Its core service is the deployment of the Cybersecurity Maturity Model for Nations (CMM) to benchmark national cybersecurity maturity across five dimensions, delivered through collaborative reviews with governments and international organizations. It also operates the National AI Cybersecurity Readiness Metric, the AI Cybersecurity Research Programme, the Cyber Resilience Blueprint, and publishes the Guide to Developing a National Cybersecurity Strategy.

Product overview

The Global Cyber Security Capacity Centre (GCSCC) at the University of Oxford is a research center focused on cybersecurity capacity building, not a commercial product company. Its core offering consists of the Cybersecurity Maturity Model for Nations (CMM), a comprehensive assessment framework used globally to benchmark national cybersecurity capacity across five dimensions. The CMM serves as the foundational methodology for conducting national reviews, which are delivered through international partnerships. Complementing this is the National AI Cybersecurity Readiness Metric, a diagnostic tool for assessing AI cybersecurity preparedness. GCSCC also produces an extensive portfolio of research publications including the Cyber Resilience Blueprint series (Unpacking Cyber Resilience, Cyber Resilience Compass), AI and cybersecurity reports, and the Guide to Developing a National Cybersecurity Strategy. The center operates through a Global Constellation network of regional partners and maintains the Cybil Knowledge Portal as a resource-sharing platform for the international cybersecurity community.

Differentiator

Problem solved

Functional benefit

Products and services

• Cybersecurity Maturity Model for Nations (CMM) A comprehensive framework for assessing and benchmarking national cybersecurity capacity across five dimensions: cybersecurity policy and strategy; cybersecurity culture and society; cybersecurity knowledge and capabilities; legal and regulatory frameworks; and standards and technologies. Used by nations to identify strengths, weaknesses, and priorities for improvement.
• National AI Cybersecurity Readiness Metric A diagnostic tool designed to enable nations to benchmark their existing AI cybersecurity readiness and provide an evidence base for AI cybersecurity decision-making. Supports countries at all stages of readiness to manage AI cybersecurity risks.
• CMM Reviews National cybersecurity capacity assessments conducted using the CMM framework, delivered through collaborative partnerships with international organizations and funding bodies. Over 90 countries have undergone CMM reviews.
• Cybil Knowledge Portal A global knowledge portal for cybersecurity capacity building resources, sharing best practices, research findings, and case studies from the international cybersecurity capacity building community.
• Global Constellation Network A global network of regional cybersecurity capacity building centres and partners that collaborate on CMM reviews and research initiatives worldwide, including OCSC, C3SA, and other regional centres.
• AI Cybersecurity Research Programme Comprehensive research initiative addressing AI cybersecurity challenges including the AI Cybersecurity Readiness Metric, AI supply chain security, and balancing risks and rewards of AI adoption.
• Cyber Resilience Blueprint A multi-year research project examining cyber resilience concepts, producing reports including 'Unpacking Cyber Resilience' and 'Cyber Resilience Compass' in collaboration with the World Economic Forum Centre for Cybersecurity.
• Cyber Harm Framework Framework for understanding and measuring cyber harm across different contexts and stakeholders, used as an analytical tool in the centre's research.
• Guide to Developing a National Cybersecurity Strategy A comprehensive guide to help nations develop and implement national cybersecurity strategies, now in its third edition.
• CMM Impact Notes Case studies documenting the impact and outcomes of CMM reviews in various countries, demonstrating how nations have used assessment findings to improve their cybersecurity posture.

Quantifiable outcome

• Over 90 countries have conducted CMM reviews using the GCSCC framework
• +2 more outcomes

Named customers8 records

Segments1 record

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Partnerships

16 partnerships are on record, tiered core and minor.

• World Economic Forum (WEF) Centre for CybersecuritycoreStrategic or Co-development Partner · 1 January 2014Long-standing collaboration on cybersecurity research, including joint publications such as 'AI and Cybersecurity: Balancing Risks and Rewards', 'Unpacking Cyber Resilience', and 'Cyber Resilience Compass'. GCSCC is a collaboration partner of the WEF and contributes to WEF Industry Strategy Meetings and Annual Meetings.
• Organization of American States (OAS)coreStrategic or Co-development PartnerGCSCC collaborates with OAS to conduct CMM reviews in Latin American and Caribbean countries. Joint work includes the Third OAS-IDB Cybersecurity Report 2025 based on CMM data. OAS CICTE co-hosted the policy dialogue webinar on AI and cybersecurity for the LAC region.
• Japan International Cooperation Agency (JICA)coreStrategic or Co-development PartnerJICA co-funds and supports CMM reviews in partner countries, notably Mongolia. Provides logistical support and expertise for capacity building initiatives in Asia.
• UK Foreign, Commonwealth and Development Office (FCDO)coreStrategic or Co-development PartnerMajor funding partner supporting GCSCC operations, CMM deployments, and AI cybersecurity research programmes globally. Partners on national CMM reviews in countries including Mongolia, Costa Rica, and Kuwait.
• UK Laboratory for AI Security Research (LASR)coreStrategic or Co-development PartnerGCSCC partners with LASR on AI cybersecurity research, including workshops and roundtable events such as those at RSA Conference. LASR is a UK government initiative focused on AI security research.
• PlexalcoreStrategic or Co-development PartnerInnovation company that partners with GCSCC on AI cybersecurity workshops and initiatives, including events in Singapore and the LASR programme. Provides industry expertise and connects GCSCC with innovators.
• Oceania Cyber Security Centre (OCSC)coreStrategic or Co-development PartnerRegional constellation partner of GCSCC based in Melbourne, Australia. Conducts CMM reviews in Pacific Island nations including Kiribati. OCSC is a not-for-profit organisation jointly owned by eight Victorian universities.
• Queens University BelfastcoreStrategic or Co-development PartnerPartners with GCSCC through the Centre for Secure Information Technologies (CSIT) on AI cybersecurity research and events including LASR initiatives. Collaborates on research showcases and workshops.
• Cybersecurity Capacity Centre for Southern Africa (C3SA)coreStrategic or Co-development PartnerRegional constellation partner based at University of Cape Town. Conducts CMM reviews in African countries including Somalia. Funded by Norwegian Ministry of Foreign Affairs.
• Cyprus Digital Security AuthoritycoreOthersNational authority that invited GCSCC to conduct second trial of AI Cybersecurity Readiness Metric in Cyprus, March 2025. Previously hosted CMM reviews in 2017 and 2021.
• Global Forum on Cyber Expertise (GFCE)coreStrategic or Co-development PartnerGCSCC supports the GFCE's Strategy and Assessments Working Group and contributes to the Cybil portal for sharing cybersecurity capacity building resources. Participates in GFCE conferences including GC3B.
• World BankcoreStrategic or Co-development PartnerPartnership on CMM reviews in countries including Ghana, Mongolia, and Costa Rica. The World Bank highlights the 2018 CMM review in Ghana as instrumental in facilitating reforms that led to improved cyber resilience.
• CommonwealthminorStrategic or Co-development PartnerGCSCC supports implementation of the Commonwealth Cyber Declaration through CMM reviews and capacity building activities in Commonwealth member states.
• British Embassy UlaanbaatarcoreStrategic or Co-development PartnerSupports GCSCC activities in Mongolia including the CMM Back Brief presentation and ongoing cybersecurity capacity building initiatives.
• University of Oxford (Internal)coreStrategic or Co-development PartnerGCSCC collaborates with Oxford Martin School, Blavatnik School of Government, and other Oxford departments on research, events, and fellowship programmes.
• Monash UniversitycoreStrategic or Co-development PartnerStrengthened research collaboration with Monash University announced September 2025. Partners on AI cybersecurity research and Global Constellation activities.

Scale indicators3 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE): NATO-accredited cyber research hub producing national-level cyber assessments, exercises, and policy frameworks; broader military/defence focus but comparable mission of building national cyber capacity and producing standards-adjacent research.
• World Bank Digital Development / Cybersecurity Capacity Building Portfolio: Multilateral development institution funding national cyber capacity programmes (including co-funding Ghana, Mongolia, Costa Rica CMM reviews); a broader-incumbent funder/convener that both commissions and shapes demand for GCSCC-type assessments.
• Carnegie Endowment for International Peace - Cyber Policy Initiative: International affairs think tank with a dedicated cyber policy programme producing research on national cyber strategy and capacity; comparable in policy-research orientation but broader in geographic and thematic scope.
• European Union Agency for Cybersecurity (ENISA): EU-level cybersecurity agency providing capacity-building guidance, frameworks, and country-level assessments across member states; comparable to GCSCC's mission of national cyber capacity assessment, but with regulatory reach and a regional (EU) focus.

Emerging players

• Atlantic Council Cyber Statecraft Initiative: Think-tank programme producing policy research and country-level cyber capacity analysis; comparable as an academic/policy outlet targeting senior policymakers, though with less emphasis on standardised national maturity assessments than GCSCC's CMM.

Direct peers

• International Telecommunication Union (ITU) Global Cybersecurity Index: UN agency that publishes the Global Cybersecurity Index, a competing international benchmarking framework for national cyber maturity; directly overlaps with GCSCC's CMM as a comparative national assessment methodology used by sovereign governments.
• Oceania Cyber Security Centre (OCSC): Regional constellation partner of GCSCC, jointly owned by eight Victorian universities; conducts CMM reviews across Pacific Island nations (e.g., Kiribati), operating an almost identical national-cyber-capacity assessment model in a defined region.
• Cybersecurity Capacity Centre for Southern Africa (C3SA): Regional constellation partner of GCSCC based at the University of Cape Town; conducts CMM reviews across African nations (e.g., Somalia), making it both a partner and a directly comparable regional capacity-building centre.
• Organization of American States (OAS) Inter-American Committee against Terrorism (CICTE): OAS body that co-funds and co-publishes the OAS-IDB Cybersecurity Report with GCSCC's CMM data and conducts national cyber capacity work in Latin America and the Caribbean; highly comparable operating model for regional capacity building.
• Global Forum on Cyber Expertise (GFCE): Multi-stakeholder platform coordinating global cyber capacity building; GCSCC is explicitly a GFCE working-group contributor, and the two organisations share the Cybil Knowledge Portal, making them directly comparable in mission and overlapping community.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/capacitycentre
• LinkedInlinkedin.com/company/global-cyber-security-capacity-centre

Revenue estimate

Valuation estimate

Number of profiles

Profiles10 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Global Cyber Security Capacity Centre (GCSCC), University of Oxford