The Commonwealth Cyber Initiative (CCI) was established under the enabling authority of the Appropriation Act - Item 252.B7, Special Session I, 2018. Its objective is “to serve as an engine for research, innovation, and commercialization of cybersecurity technologies, and address the Commonwealth’s need for growth of advanced and professional degrees within the cyber workforce" (Virginia State Budget, 2018).

Our ambitious vision is to establish Virginia as a global leader in cybersecurity, and by doing so, help diversify the economy of the commonwealth, attracting private investment and jobs.

Fiscal Year 2022 (FY22) was our most productive year yet: research funding from sources outside the commonwealth continued to grow, and we have substantially expanded our workforce development and innovation programs. Virginia is unique in the country in establishing this large-scale collaboration among 41 institutions of higher education, and the investment continues to pay off in jobs (and, crucially, a skilled workforce that can fill those jobs!), spin-outs and startups, and the reputation of our academic institutions.

This report highlights some of the major accomplishments from the past fiscal year, which are indicative of what the CCI network is achieving for the commonwealth.

New Research Grants. CCI researchers brought in $38 million in new research grants and contracts to Virginia in FY22. This astounding success comes from our depth and breadth of expertise in cybersecurity and is enabled by the unique research facilities that CCI has established. We are now competitive for large-scale funding in key areas such as securing the next generation of communication networks, sometimes referred to as Next G. CCI researchers are uniquely positioned to contribute to national priorities such as Open Radio Access Network (O-RAN), a topic for which the recent CHIPS and Science Act has authorized an investment of $1.5 billion. Many of our research projects have a strong hands-on, testbed component, providing students (pictured) with valuable practical skills in the design and deployment of secure systems.

Intra-Network Collaboration. The secret sauce to what CCI is achieving is the collaboration that flourishes among our universities and colleges. A recent report from RTI International points out: "The research profile of Virginia universities has grown at a rate outpacing national averages, but they are still small as individual institutions. CCI can serve as a valuable convener to help universities collaborate to elevate their research profile." We are doing exactly that. As an example, we recently received a planning grant from the National Science Foundation (NSF) to build the first industry-university center in Next G: four CCI universities, Old Dominion University (ODU), George Mason University (Mason), Virginia Commonwealth University (VCU), and Virginia Tech (VT), were funded, and our proposal included letters of collaboration from 52 industry partners. To build additional partnerships, our first network-wide CCI Symposium (pictured) took place in April 2022 in Richmond, bringing together 200 faculty members and students.

Research and Innovation Infrastructure. The family of CCI testbeds continues to grow. This year, we inaugurated three new testbeds at VCU. The medical device security testbed is outfitted with real commercial medical devices that are tested for security vulnerabilities and used to develop mitigation solutions. The OpenCyberCity testbed (pictured) is a realistic, small-scale cityscape in which to run experiments related to smart cities and autonomous vehicles. It has a fully operational water treatment plant, miniature Uncrewed Autonomous Vehicles (UAVs), and a range of smart city sensors. And, complementing CCI’s xG testbed, VCU now has an isolated environment where we can conduct 5G and Next G experiments without causing or suffering interference. The CCI Northern Virginia (NoVA) Node added two commercial grade testbeds in addition to three open-source testbeds that were instantiated the previous year. The suite of testbeds enables self-contained, mobile architecture independent of commercial providers to support numerous physical system applications ranging from autonomous vehicle and transportation systems to manufacturing and supply chain. CCI’s research facilities are used for research, experiential learning, and to inspire entrepreneurship and spin-out companies.

New Research Frontiers. In FY22, we refreshed our major research themes, taking into consideration workforce needs, researcher expertise, and potential for funding, innovation, and partnership with industry. Our new research themes are "Securing the Next Generation of Networks" and "Securing Human-Machine Interactions." The goal of the former is to position CCI to play a leading role in the secure deployment of 5G and in the vision for Next G. It includes research areas such as open interfaces and standards, virtualization and network disaggregation, secure and flexible use of spectrum, integration of cyber physical systems, and quantum communications. In this context, the CCI Southwest Virginia (SWVA) Node seeded the launch of a new Center for Quantum Information Science and Engineering (lead researchers pictured) at VT, which has already been very successful in attracting major research funding and publishing contributions in some of the top journals in the area. The second research theme, Securing Human-Machine Interactions, focuses on the technological challenges in securing an enhanced digital experience. Building on CCI’s philosophy of cybersecurity as inherently multi-disciplinary, this theme deals with research areas such as ethical cybersecurity, the metaverse, Artificial Intelligence (AI) assurance, and security and privacy for embedded devices.

Rich Experiential Learning. We are particularly proud of the experiential learning programs that CCI continues to create. This year, the CCI NoVA Node launched a new apprenticeship program. In the first cohort (pictured) we are funding 21 apprentices for seven weeks of full time training and 12 weeks of apprenticeships. Hosts include Arlington County, Peraton, Inter-Sec, DEKRA, and Sedulous, with additional companies being onboarded. Many of the apprentices are transitioning from other careers, and the expectation is that they will receive offers of full-time employment from the hosts. This year we also launched new experiential programs in sectors related to election security, privacy protection, and digital forensics. Two of these programs are in partnership with the Virginia Board of Elections and the Virginia State Police. Two aspects that are common to all these experiential learning programs deserve to be highlighted: the level of interest from students and professionals, and the diversity of the cohorts. Take the apprenticeship program as an example: we had 400 applicants for 21 positions; among the selected apprentices, 43 percent are female, 19 percent are veterans, and 90 percent identify with underrepresented groups in science and engineering. There are clear lessons: (1) making rich experiential learning opportunities available to all can substantially contribute to diversifying the cyber workforce; and (2) there is tremendous opportunity to scale up all these programs.

Spin-outs and Startups. We are now directly supporting work in dozens of cyber startups in Virginia (the logos on the left represent a sample). These engagements vary from internships paid by CCI to funding for translational research in collaboration with CCI faculty members. This year saw the emergence of two CCI spin-outs: Symple Solutions leverages Field Programmable Gate Array (FPGA) technology for verifiability of critical cyber-physical systems; and Virtual PLC provides automation of collection and analysis of adversarial data for critical infrastructure customers. Both received seed funding from the CCI Central Virginia Node (CVN) and are part of VCU’s Dreams 2 Reality incubator. This year we also launched the CCI Incubator and Accelerator (CCI+A) program. Led by the CCI NoVA Node and co-funded by the CCI Hub, the Cyber Acceleration, Translation, and Advanced Prototyping for University-Linked Technology (CATAPULT) fund provided $50,000 grants to eight new translational research projects led by CCI faculty. These projects are either conducted in partnership with existing startups or aim at creating new spinout companies. Startups participating in the CCI+A program participate in a rigorous program designed to expedite the commercialization, and also receive mentorship from volunteer industry experts, free legal and business consulting, and access to rent-free space in the Digital Innovation Pilot facility at Mason.

Internships, from High School to Grad School. CCI now funds a range of paid internships. Two of these programs are aimed at high-school students, including those who are home-schooled: In SWVA, seven students are paired with Virginia Military Institute (VMI) cadets to work on hardening Internet of Things (IoT) devices such as Google Home and Alexa-enabled devices (pictured). In NoVA, our summer 2021 internship program for high school juniors and seniors received 110 applications for 20 positions, leading us to increase the number of positions to 30 in summer 2022. The CCI Hub funded, for the third year in a row, our Cyberstartups program hosted and run by Mason and leveraging the participation of the entrepreneurs incubating in their Mason Enterprise Centers across the region. The program provides stipends for undergraduate and graduate student internships in Virginia startups focusing on cybersecurity with host companies also providing matching resources. We also continue to fund cybersecurity internships as part of the Commonwealth STEM Industry Internship Program (CSIIP), resulting in 54 placements in 13 companies: 42 percent of these interns are women, 17 percent are military veterans, and 50 percent are persons of color; we find that 91 percent of interns remain in the cybersecurity field after their internships. Finally, the second CCI Internship Fair took place in October 2021, with 300 students participating in the two-day virtual event, which included industry booths, interviews, and job panels.

The Next Generation of Entrepreneurs. We view forming the next generation of business creators as an important component of our innovation mission. In the first week of January 2022 we welcomed 25 students to our Arlington hub for one week of intensive training in CCI’s inaugural Innovation Boot Camp. The event, facilitated by BMNT, exposed students to innovative business practices used in Hacking4X courses across the country to tackle real-world problems from government and industry challenge sponsors. Challenge sponsors included CACI International, the Cybersecurity and Infrastructure Security Agency (CISA), and the Virginia Office of Public Safety and Homeland Security. Additionally, the CCI Coastal Virginia (CoVA) Node led our third cohort of the Innovate Cyber program, opening the program to students from all two- and four-year institutions represented in CCI. A total of 54 students from 14 universities and colleges learned about design thinking and worked in multi-institution teams to devise products to improve cyberhygiene.

CCI funding is distributed to researchers through open calls for proposals issued both by the Hub and the Nodes. Proposals are peer-reviewed and final recommendations made by CCI’s Leadership Council. This ensures that the best ideas, aligned with CCI’s mission, are selected for funding in an open and transparent manner.

We continue to be advised by a highly distinguished Technical Advisory Board (TAB), with representatives from industry, state and federal government, academia, and the innovation ecosystem. Some major goals for the coming fiscal year include:

• Continuing to develop cross-disciplinary approaches to cybersecurity, focusing on the research theme of securing human-machine interactions and exploring technical, legal, social, and public policy aspects.

• Strengthening and supporting multi-institution teams in Virginia to compete for large-scale research and workforce development grants from the federal government and industry.

• Expanding our innovation programs, connecting our researchers with venture capital, and continuing to align our innovation initiatives with those available through the Virginia Innovation Partnership Corporation (VIPC) and other sources.

• Scaling up our internship and apprenticeship programs.

• Extending our research infrastructure with a new outdoor 5G and Next G testbed using Citizens Broadband Radio Service (CBRS) licensed spectrum.

• Raising our profile and building new partnerships nationally and internationally.

CCI is now three years old. The level of maturity in our workforce development and innovation programs is noticeable, and the collaborations between universities are stronger than ever. The commonwealth’s leadership deserves credit for having the foresight of establishing this initiative years ago and for their continued focus on cybersecurity as a critical area for Virginia. Our results to date show how we can be an engine for the commonwealth’s economic development.