The Power of Volunteers - PH Cyber Units

By Hadyn Green
Wednesday, October 28, 2026

It’s not often acknowledged, but cyber security owes a lot to volunteers. People who are dedicated enough to give up their time to help others through building open source tools, being available as mentors, or running training.

Alwell Mulsid is head of Cyber Incident Response Section at CERT-PH in the Philippines - a brand new full member of FIRST - and on weekends he runs the Philippine Cybersecurity Union of IT and Computer Science Professionals (PH Cyber Units for short). These are technically focused training sessions for cyber security professionals from government and private sector organizations.

The reason why is that the Philippines' frontline cybersecurity experts have a scheduling problem. The people who most need advanced technical skills can rarely get approval to leave their desks for training. Weekdays belong to operations. Weekends belong to everything else.

Alwell saw that gap and decided to fill it with a volunteer-run, non-profit advocacy group that trains people on their own time for free.

The model is deliberately old-school with face-to-face interactions and a BYOD set-up. While webinars are cheap and scalable, Mulsid found they often fall short on complex subjects like forensics, where the learning happens “in the doing, not in the watching”.

What the PH Cyber Unit covers isn't set from a standard curriculum. Topics come directly from what natCSIRT responders encounter in the field, so participants practice on the problems they'll actually meet. The current offering is a three-module laddered series on incident response and forensics, building from fundamentals toward advanced practice.

Logistics get the same pragmatic treatment. Materials go out in advance, so nobody is stuck downloading large files over unreliable venue wi-fi. Governance is equally grounded. The PH Cyber Units is registered as a non-profit advocacy group with a board of directors drawn from both government and private-sector volunteers.

The last hurdle is venue. It’s tough finding a good spot that can accommodate a room full of cybersecurity people who need power and internet access. Let alone finding one that is accessible on a weekend, which rules out a lot of government buildings, and doesn’t charge hotel conference rates.

PH Cyber Units found the perfect solution: a shopping mall. Malls are accessible by public transport, open on weekends, large enough to absorb serious demand, and those attending the courses can bring their families to shop or watch movies. Registration has now reached as high as 300 applicants for a single session.

The group is Manila-based but has already run trainings in other regions. Alwell’s goal is to create volunteer-led units across the provinces outside the capital. The idea is local people training local people, rather than everyone depending on a single travelling team of outside consultants, even if “outside” is just another part of the country.

As part of this, Alwell stressed to me the importance of boosting women in cybersecurity. Women are very underrepresented in cyber security and even less so in training. So, women-led training for women makes a lot of sense.

A dedicated subunit of PH Cyber does exactly that. It's a small structural choice with an outsized effect. And it is having an effect, changing the perception of who a cyber security expert is.

The community doubles as a networking hub, and the results are tangible: attendees have gone on to land professional cybersecurity roles. For a country short on skilled defenders, that pipeline matters far more than any individual session.

Honestly at this point of the chat with Alwell, I’m amazed by how good of a set-up this is. That means the next question is, where does Alwell want this to go from here?

Firstly, the current PH Cyber program has a few topics that have a ‘ladder’ of classes that expand on the topic with each class. Alwell wants more topics to follow that pattern, such as threat monitoring.

Second, is the regional scaling mentioned above. Identifying and recruiting volunteers to lead physical trainings in their own provinces.

The last part is administrative support. Alwell is doing a lot of the work and needs more volunteers to manage the community page, organize sessions, and secure venues, easing the load on him. Although he will tell you might be the last person to give up total control of this project that he loves.

Plenty of cybersecurity initiatives fail for, what he calls, ‘boring reasons’. They don’t have the budget or the time, they lack a good venue or no one buys into it. The PH Cyber Units approach Alwell is using works because it treats each of those as a design constraint rather than an excuse. Real incidents become the syllabus. Weekends become the timetable. A mall becomes the campus. Volunteers become the faculty.

It's not glamorous, and it isn't meant to be. It's a system built to fit around the lives of working professionals who can't step away from the job. Because of this, PH Cyber Units has widened the country's pool of people who can actually respond when something breaks.

—

This blog is part of a series with FIRST’s current and former Suguru Yamaguchi Fellows, sharing lessons learned and showcasing how they work.