03 · The allocation
$1.5 million for AI.
Eight hours a week for security.
Drupal can raise money. In 2026 it raised more than $1.5 million in cash and in-kind commitments from 28 organisations to build AI features. In the same year, the person who ships Drupal's security releases was funded for eight hours a week, down from forty in 2022, while the Association's reserves fell below its own policy floor.
Two budgets, one ecosystem
The comparison is two published numbers.#
Drupal AI Initiative · 2026
$1.5M+
- 28 organisations pledged cash and in-kind support
- 23 full-time equivalents, 50+ people
- Deliverables: page generation, background agents, AI-assisted authoring
- Announced as proof the ecosystem can organise and fund shared work
Source 1
Core release management · 2026
8 hrs/wk
- One person, funded part-time, shipping the security releases
- Down from 40 hours a week in 2022
- Sponsors listed: Acquia, Agileana, HeroDevs, Salsa Digital, Zoocha, QED42
- Two decade-long sponsorships of this work ended in 2022 and 2026
Source 2
Nothing in the AI budget was stolen from security. That is what makes the comparison useful: it is not a story about misappropriation, it is a story about what an ecosystem chooses to fund when it is asked. The same network of companies that found $1.5M for features could not find full-time funding for the release pipeline that keeps every one of their customers' sites patchable.
we argue The AI Initiative is evidence for this page, not against it. It proves the money exists.
I am currently funded for 8 hours per week. In 2022, I was funded for 40. … If I cannot find funding for 2027, I will need to leave funded open source work entirely.
The person who wrote that is not a contractor making a pitch. xjm has been a Drupal core committer for over a decade and sits on the security team that wrote the 8-month policy. Her funding page states the arithmetic: 8 funded hours now, an expected additional 7, and a need for 12–16 more to restore the role. Savings made up the difference until they ran out.
This is the part of the story that a chart cannot carry. Drupal's security releases are not produced by a process. They are produced by a handful of specific people, one of whom has published her hours and said she will leave if 2027 is not funded.
The role, in hours
- 2022
- 40 hrs/week funded
- May 2026
- 8 hrs/week funded
- Expected addition
- +7 hrs/week
- Stated need
- +12–16 hrs/week to restore the role
- Funding level
- lowest since 2012
The audited accounts
The Association has been running a structural deficit for three years.#
All figures: Drupal Association 2025 audit and financial overview (published July 2026). 3
Reserves, in months of operating expenses
2.3months
The Association's own framing is candid: it missed a plan to triple revenue, its out-of-pocket costs rose 27% while cash revenue rose 5%, and its infrastructure bill (Drupal.org itself) grew 61% with no dedicated funding mechanism attached.
The line that should stop a reader is the donated-services one. Nearly half of Drupal.org's costs are now covered by donated or in-trade services, up from 19% in 2022. That is the goodwill of a small number of vendors booked as revenue, not a funding stream.
we argue An organisation whose core infrastructure is half-funded by favours cannot credibly promise to fund a security team out of the same account. The 8-month support window is what that arithmetic looks like when it reaches the advisory queue.
Where the money would come from
Drupal does not have a revenue problem. It has a payer problem.#
The users
48.3% of Drupal sites run an unsupported major version. Those owners are consuming the platform's security reputation without contributing to its maintenance. 4
The vendors
They fund features, events and marketing. The release pipeline is funded at 8 hours a week by six named sponsors. Both facts are published. 2
The foundations
Alpha-Omega and the sovereign-tech grant paid for 87% of the last five months of advisory work. A grant with an end date, not a revenue line. 5
The project's own funding page lists what is missing in hours, which makes it unusually easy to check whether the gap closed. We will keep checking, and we will publish it if it does.
Sources for this page
1Drupal.org: AI Initiative: from strategy to execution
$1.5M+ in cash and in-kind commitments from 28 organizations, 23 FTE, 50+ people.www.drupal.org/about/starshot/initiatives/ai/blog/from-strategy-to-execution-how-the-drupal-ai-initiative-is-scaling-delivery-for-2026 retrieved 8 Nov 2026
2xjm: Core security funding
I am currently funded for 8 hours per week. In 2022, I was funded for 40.xjm.drupal.org/blog/core-security-funding retrieved 8 Nov 2026