Skip to the page content
Your donations
Passes our checks

Forum of Incident Response and Security Teams

EIN 38-3943584 · Cary, NC

Public records show a registered, tax-exempt organization in good standing.

LegitimacyPassesRegistration and standingFinancial healthGood89 out of 100GovernanceStrong100 out of 100Impact evidenceDescribes programsHow well its results are evidenced

What it says it does

FIRST aspires to bring together incident response and security teams from every country across the world to ensure a safe internet for all. Effective response is a global task, mirroring the global nature of the internet. Based on a peer to peer network governance model, computer security incident response teams (CSIRTS), product security incident response teams (PSIRTS) and independent security researchers work together to limit the damage of security incidents. This requires a high level of trust; the fuel our members run on. FIRST fosters trust building among member through a variety of activities. Incidents are not confined to one cultural or political corner of the internet, nor do they respect borders or boundaries. FIRST thus promotes inclusiveness, inviting membership from all geographic and cultural regions.

Income
$5.7 million
Spending
$4.6 million
Spent on programs
83%
Reserves
7 months of spending
Largest source of income
fees for its services, 60%
Employees
1
Volunteers
65
Highest pay
$237,915, executive director

Source: Form 990 for the year ending December 31, 2024, filed with the Internal Revenue Service. Rating method 2026.2. How we rate

Financial health

Good: 89 out of 100. Higher than 79% of charities in its peer group (education, $1m to $10m).

  • Reserves

    28 of 35

    Spendable reserves would cover 7.0 months of spending.

  • Debt

    16 of 20

    It owes 29% of what it owns.

  • Living within its means

    15 of 15

    Income exceeded spending by 19% of income.

  • Income trend

    15 of 15

    Income rose 77% on the year before.

  • Spending floor

    15 of 15

    83% of spending went to programs and raising each dollar of donations cost 0 cents.

Source: Form 990 for the year ending December 31, 2024, filed with the Internal Revenue Service. Rating method 2026.2. How we rate

Governance

Strong: 100 out of 100. Higher than 74% of charities in its peer group (education, $1m to $10m).

  • Independent board

    25 of 25

    10 of 10 voting board members are independent.

  • Conflict of interest policy

    15 of 15

    Has a written conflict of interest policy.

  • Whistleblower policy

    8 of 8

    Has a written whistleblower policy.

  • Record keeping policy

    7 of 7

    Has a written policy on keeping and destroying records.

  • Board minutes

    5 of 5

    Keeps minutes of board meetings.

  • Board sees the tax return

    10 of 10

    Gave the board a copy of this return before filing it.

  • Pay set independently

    5 of 5

    Sets its chief executive's pay through independent review and comparison.

  • Independent check of accounts

    15 of 15

    Its accounts were audited by an independent accountant.

  • No reported misuse

    10 of 10

    Reports no diversion of assets, excess benefits or loans to insiders.

Source: Form 990 for the year ending December 31, 2024, filed with the Internal Revenue Service. Rating method 2026.2. How we rate

Impact evidence

Describes programs. Its tax return describes what it does but we have found no measurable results in it.

Programs described in its return (3)
  1. $2.7 million spent. FIRST held its 36th annual conference in Fukuoka, Japan with a virtual option in June 2024. More than 1055 security professionals from over 103 nations attended sessions on industry best practices, reviews of incident handling, and tools and training, and heard keynotes from industry recognized experts.
  2. $897,517 spent. Besides the annual conference, FIRST and its members organize in-person events around the globe which typically have a regional or topical focus. These events cater to a more specialized or local audience. Community driven, these events help participants to force valuable connections which are invaluable during a security incident. Participants discuss security-related technical topics, tools as well as best practice. Many of the events co-host training courses in the area of incident response. In 2024, there were 8 in-person regional events, some with virtual participation.
  3. $280,754 spent. FIRST provides several online services supporting members in handling security incidents more efficiently. This includes a website containing verified contact information, best practices, and much more information. Operational information is made available through electronic interfaces to be incorporated directly into members' tools. FIRST has over 746 member teams located in 111 countries. Member teams include large vendors, national certs, telcos, research institutes, and many more. FIRST Hosts International Standards like the common vulnerability scoring system (CVSS).

Source: Form 990 for the year ending December 31, 2024, filed with the Internal Revenue Service. Rating method 2026.2. How we rate

Legitimacy checks

  1. Is it registered with the IRS? Passed.

    Listed in the IRS master file of tax-exempt organizations as a 501(c)(3) charitable organization.

    Source: Exempt Organizations Business Master File, Internal Revenue Service, file dated October 13, 2026.

  2. Has the IRS revoked its tax-exempt status? Passed.

    Not on the IRS automatic revocation list.

    Source: Automatic revocation of exemption list, Internal Revenue Service, file dated October 13, 2026.

  3. Are donations tax-deductible? Passed.

    On the IRS list of organizations eligible to receive tax-deductible contributions.

    Source: Publication 78 data: organizations eligible for tax-deductible contributions, Internal Revenue Service, file dated October 13, 2026.

  4. Is it keeping up with its IRS filings? Passed.

    Most recent return on file covers the year ending December 2025.

    Source: Exempt Organizations Business Master File, Internal Revenue Service, file dated October 13, 2026.

  5. How long has it been tax-exempt? Passed.

    Recognized by the IRS since February 2015.

    Source: Exempt Organizations Business Master File, Internal Revenue Service, file dated October 13, 2026.

  6. Is it in good standing with state regulators? Passed.

    Not on California's list of charities barred from soliciting. Other states are not yet checked.

    Source: May Not Operate or Solicit for Charitable Purposes list, California Attorney General, Registry of Charities and Fundraisers, file dated October 21, 2026.

Ratings and checks are our reading of public records, using the published method. They are not a statement about anyone's honesty. If you work for this organization, you can send corrections or results, confirm you want gifts through Veridonate, or ask to be removed from giving.