Firewalls Over Oilfields: Why Azerbaijan Needs to Invest in Cybersecurity R&D

The AnewZ Opinion section provides a platform for independent voices to share expert perspectives on global and regional issues. The views expressed are solely those of the authors and do not represent the official position of AnewZ

Last year, Azerbaijan blocked more than 260 million malicious cyberattacks. The message is clear: our future security will not depend on oil, but on code. When it comes to research and development (R&D), sectoral priorities matter just as much as oil and gas.

One of the fastest-growing global R&D domains today is cybersecurity. According to Gartner, global spending on cybersecurity is skyrocketing, set to exceed $240 billion by 2026. In the European Union, public R&D budgets also show significant momentum: the Horizon Europe “Civil Security for Society (Cluster 3)” program has earmarked €231 million for 2025, a €30 million increase from 2024, directly funding security and cybersecurity projects. Meanwhile, WIPO data show that patent applications in computer/ICT technologies increased by an average of over 10% annually between 2012 and 2022; WIPO Patentscope and independent surveys also show a significant increase in cybersecurity-related patent applications in recent years. Taken together, these signals confirm that cybersecurity is one of the fastest growing and most strategically vital fields of R&D worldwide.

Situation is slightly different in Azerbaijan, however. According to Report Information Agency, in the first half of 2025 there were 504 indicators of cyberattacks (IOCs) targeting government institutions—a 1.2% increase compared to the previous year. Through the AzStateNet network, authorities blocked 262.92 million malicious connections, while the central antivirus system intercepted 12.36 million infected electronic documents, and the sandbox system neutralized 61,482 harmful files. The threat landscape cuts across sectors: nearly four out of ten cyberattacks in Azerbaijan target the oil and gas industry— the backbone of the national economy.

The government is not standing idle. The 2023–2027 National Information Security and Cybersecurity Strategy explicitly prioritizes the protection of critical infrastructure. A joint commission between the State Security Service (SSS) and the Special State Service for Communication and Information Security (SSSCIS) has strengthened oversight and incident response at the national level. On paper, Azerbaijan ranks among the top countries in global cybersecurity indexes. However, the country still imports most of the technologies it depends on.

The core question we must ask is this: if Azerbaijan ranks well in strategy, why is it still lagging in developing its own cybersecurity technologies?

Looking at the data, Azerbaijan’s R&D spending as a share of GDP has remained strikingly low in recent years. Azerbaijan invests less than 0.2% of its GDP in R&D — far below the global average, and light years behind leaders like Israel at 6%. In global comparison, Azerbaijan’s allocation to R&D remains very limited, underscoring the need for greater investment if the country is to strengthen its competitiveness. The world average stands at around 1.9%, while advanced economies are far higher: Israel at 6.0%, the United States at 3.6%, and Germany at 3.1%.

In cybersecurity technologies, Azerbaijan remains heavily dependent on foreign products. To mitigate this reliance and strengthen digital sovereignty, the government has pursued a mix of strategies and partnerships. Some Azerbaijani government agencies use Kaspersky solutions, making it one of the most widely adopted providers of security software in the public sector. In addition, Azerbaijan has partnered with Fortinet, a collaboration that has enhanced its defensive capacity against cyber threats. For example, official documents confirm that the state’s Electronic Security Service works with Fortinet, and that AzInTelecom partners with Kaspersky Lab.

At the same time, the state has woven into its 2023–2027 National Cybersecurity Strategy an explicit emphasis on reducing dependence on foreign technology, fostering domestic innovation, and raising national awareness in this field. Practical steps include building national data centers and expanding government cloud services (G-Cloud) to reduce reliance on foreign servers and infrastructure.

On the other hand, university–industry collaboration remains insufficient, with most cybersecurity research confined to academia. Forecasting its future trajectory is difficult, yet there are encouraging signs that such cooperation is beginning to take shape in Azerbaijan. Some universities have begun creating cybersecurity labs and partnerships with local firms, but these remain scattered pilot projects. In July 2024, the Azerbaijan Technical University (AzTU) met with the Innovation and Digital Development Agency (IDDA) and the Azerbaijan Cybersecurity Center (ACC) to draft a joint roadmap covering ecosystem development and startup support.

The Association of Cybersecurity Organizations of Azerbaijan (ACOA) convened a roundtable in January 2024, bringing together representatives from 16 higher education institutions and several companies to discuss expanding cooperation, creating student cybersecurity clubs, and enhancing internships. In November 2024, the Azerbaijan State Oil and Industry University (ASOIU) launched a Cybersecurity Laboratory with participation from Prosol, though the focus remained limited to educational activities. Similarly, the Baku State Vocational Education Center (Industry and Innovation) signed an agreement with the ACC under the “Brain Center” program in February 2025, committing to curriculum updates, internships, seminars, and club creation.

In July 2025, IDDA also announced new initiatives to support universities and cybersecurity clubs, offering AI and cybersecurity training to businesses and extending cooperation with higher education institutions. These developments, while promising, remain scattered and insufficient for a genuine transformation. For a genuine transformation, collaboration must be deepened and scaled through stronger policy incentives, targeted funding models, and long-term commitment.

Of course, expecting the state alone to shoulder the responsibility would be naïve. The private sector’s disengagement is equally visible: large companies often outsource their cybersecurity needs rather than investing in their own internal capabilities. Most large companies prefer outsourcing their cybersecurity instead of building in-house expertise — leaving little room for local innovation.

International partnerships sound impressive, but they often reinforce foreign dependence. For example, Partnerships with foreign institutions have boosted training, but they also deepen our dependence on imported expertise instead of building our own capacity. Similarly, according to Apa.az, collaborations with Mobileye and Checkpoint are on the horizon, but again, these tilt toward adopting international technologies instead of fostering homegrown ones.

While outsourcing is common, it carries serious long-term consequences for Azerbaijan’s digital sovereignty. A lack of in-house expertise, weak financial incentives, and regulatory issues make it difficult for local cybersecurity firms to scale. While ACC has contributed through public training programs, private-sector–oriented incentives remain limited. Strategically and culturally, many institutions continue to entrust critical infrastructure security to globally established vendors rather than experimenting with emerging local solutions.

Another pressing challenge that Azerbaijan shares with many other countries is brain drain. In cybersecurity, this brain drain is not just an economic loss — it is a national security risk. From a security standpoint, this should not be underestimated. Limited education and employment opportunities are among the key drivers of this outflow. Unless these underlying issues are addressed, Azerbaijan risks losing the very human capital it needs to build its cybersecurity future.

What does the future hold?

So where do we go from here? There are several practical solutions that could help chart a way forward. One option is to establish a Cybersecurity R&D Fund Line dedicated to local innovation. If more funds are invested in cybersecurity R&D, Azerbaijan could develop dozens of homegrown prototypes within just two years. Grants, public–private proof-of-concept (PoC) funds, and venture capital co-financing could accelerate the process.

Tax incentives would also provide much-needed relief for startups. Through the Startup Certificate scheme and technopark membership, companies could receive up to 10 years of exemptions, lowering operational costs by more than 20%. Within three years, this could enable at least five new cybersecurity ventures to establish themselves in technology parks.

Another priority should be building an International Consortium Bridge. Programs such as the EU’s EU4Digital initiative and cooperation through the Organization of Turkic States could provide SMEs and public teams with training aligned to international standards. In the medium term, participation in Horizon Europe—the EU’s flagship programme for R&D—through consortium-based project calls would enable Azerbaijani companies to benefit from European R&D funding streams.

According to official and local reports, as of 28 February 2024 a total of 110 state institutions had either fully (36 institutions) or partially (74 institutions) migrated their information systems to Azerbaijan’s Government Cloud (G-Cloud), which can serve as a testbed for small-scale cybersecurity pilots. For instance, running a 3–6-month pilot of a domestic endpoint detection and response (EDR) tool in a single agency would create a rapid validation mechanism for homegrown solutions.

In conclusion, Azerbaijan’s shift away from external dependence in cybersecurity and toward producing its own technologies is not merely a matter of preference, but a question of national security and economic sovereignty. Decisive steps taken today — from creating domestic R&D funds and offering tax incentives, to building international bridges and scaling public-private pilot projects — could position Azerbaijan tomorrow as not only a user but an exporter of cybersecurity solutions across the region. But if Azerbaijan fails to act now, it risks remaining permanently dependent on foreign technologies, vulnerable to external shocks, and unable to fully protect its digital future. The solution is clear: by investing boldly today, the country will unlock the path to progress and prosperity tomorrow.

Copied