Useful open-source software needs people to review contributions, fix vulnerabilities and keep a project usable after its first research funding ends. NSF’s Pathways to Enable Secure Open-Source Ecosystems program makes that continuing work part of the funding proposition.
NSF announced June 9 that it planned to invest up to $40 million through the program, known as PESOSE. The solicitation addresses existing open-source products and the communities needed to sustain them, with three tracks:
| Track | Maximum award | Duration |
|---|---|---|
| Planning | $300,000 | One year |
| Expansion | $1.5 million | Two years |
| Security | $1.5 million | Two years |
The planning track supports the work of designing an ecosystem around a product. Expansion supports its growth. The security track asks teams to address identified security needs and define ways to measure improvement.
The requirements extend beyond a list of software features. Proposals must explain governance, maintenance and how the project will attract and support users and contributors. They also call for three to five letters from current external users or contributors. That gives reviewers evidence of a community beyond the people requesting the award.
The security track makes the same principle concrete: a proposal must connect work to the project’s vulnerabilities and security needs, with metrics for assessing progress. Adding a security label to a general development plan is not the program’s stated objective.
NSF also incorporated Innovation Corps training into the planning and expansion tracks, with a possible waiver for an expansion team that had already completed the required training under a planning award. August guidance described virtual sessions over several weeks and a team of up to three people covering technical leadership, outreach and a mentor role.
In this setting, outreach means learning from the people who use or contribute to the project. Their needs can shape documentation, contribution practices and the work that maintainers prioritize. It does not require treating every open-source effort as a future proprietary software company.
The first submission deadline was September 1, 2026; the solicitation also lists a March 2, 2027 deadline. The announced funding ceiling does not establish which teams received awards.
The program’s design gives maintenance a place in the project plan from the start. Reviewers are asked to consider not only whether the code is useful, but who will care for it, how decisions will be made and what evidence will show that its security has improved.
Sources
- NSF investing in secure open-source ecosystems — National Science Foundation · 2026-06-09.
- NSF 26-506: Pathways to Enable Secure Open-Source Ecosystems — National Science Foundation.
- NSF Innovation Corps training for Pathways to Enable Secure Open-Source Ecosystems recipients — National Science Foundation · 2026-08-12.