The National Cyber-Forensics and Training Alliance (NCFTA) is a nonprofit corporation founded in 2002, focused on identifying, mitigating, and disrupting cyber crime threats globally.

The NCFTA was created by industry, academia, and law enforcement for the sole purpose of establishing a neutral, trusted environment that enables two-way information sharing with the ultimate goal to identify, mitigate, disrupt, and neutralize cyber threats. Through the NCFTA, private industry and government are able to work together in this neutral, trusted environment.


Establishing trusted relationships is critical to information sharing, and sharing near real-time information is important to our partners. But that’s just the first step. Our partners understand that information isn’t necessarily intelligence. Getting to intelligence takes going beyond information or indicators. It takes people, process, and a bit of technology. Our team of analysts applies the human factor to information sharing and intelligence gathering. Using shared information and our unique on-site collection of historical data, we strive to identify actionable intelligence for our industry and law enforcement partners.


When law enforcement needs help understanding an event, it relies on the NCFTA community of industry partners to provide insight into the scope and impact of the threat. When industry needs a receptive ear from law enforcement, the embedded agencies at the NCFTA are there to discreetly listen. These trusted relationships enable industry and law enforcement to align priorities and resources without compromising privacy, ethics, or the integrity of an investigation.


On-site Resource: Funding partners have the unique opportunity to embed a resource on-site at one of three NCFTA offices.  While the resource reports to their own management, they work alongside our team of intelligence analysts, other industry subject matter experts, and law enforcement agents to discuss current trends, identify threats, and share best practices.

Remote Partnership: If unable to embed a resource, partners may choose to join the NCFTA as a remote partner.  Remote partners are virtually supported by our teams of NCFTA intelligence analysts and have access to other industry peers through various communication channels, working group conference calls, webinars, and more.


The NCFTA community includes cross-sector industry and law enforcement and offers the opportunity to co-locate in our neutral environment. This unique environment allows for true collaboration and spontaneous “aha!” moments to occur.


Organizations looking to augment their existing business risk efforts

The NCFTA acts as an extension of your team and force multiplier for cybersecurity and threat intelligence teams, fraud prevention groups, and brand/intellectual property protection specialists.

Organizations with limited intelligence resources

The NCFTA provides access to a dedicated team of analysts working across initiatives as well as a community of trusted industry partner SMEs (subject matter experts). All of our partners also have direct access to a committed, highly motivated cadre of domestic and international law enforcement professionals.

Responsible stakeholders who want to make an impact for the greater good

Partners are provided with regular updates on trends, emerging threats, and near real-time threats through numerous communication channels, feeds, peer calls, working groups, intelligence reports, and white papers.

Beyond collaboration and information sharing, we strive for measurable results:*

  • 4,184 cases referred to law enforcement
  • 26,945 intelligence reports produced
  • 1,179 arrests made with NCFTA contributions
  • $178,010,864 in seizures by law enforcement
  • $12,248,814,091 in losses prevented
*As reported by law enforcement and industry partners, 2015-2021 calendar years.