For most small organisations, the front door is no longer a physical entrance. It is an email inbox — and it is being tried with growing persistence. Research reported in March 2025 by Infosecurity Magazine, drawing on data from Abnormal Security, found that email-based threats against nonprofits had risen by 35.2 per cent in a year. Credential phishing rose by 50.4 per cent and malware attacks by 26.2 per cent.
Why nonprofits are attractive targets
The reasons are structural rather than accidental. Nonprofits typically operate with limited security resources, rely on high-trust relationships and process frequent financial transactions: grants received, suppliers paid, donations acknowledged. An attacker impersonating an executive director or a trusted vendor needs only one convincing message to redirect a payment.
The defences that matter most
Having spent my career in technology leadership, I would answer the question of which security investments deliver the greatest protection for the least money in reassuringly unglamorous terms:
- Multi-factor authentication on every account. It neutralises the great majority of stolen-password attacks and is usually already included in the tools organisations use.
- A payment-verification rule. Any request to change banking details or make an urgent payment is confirmed by telephone, using a number already on file.
- Regular, blameless training. Staff and volunteers who can recognise a suspicious message — and who feel safe reporting a mistake — are the most effective filter available.
- Tested backups. A backup that has never been restored is a hope, not a plan.
- Least-privilege access. People should hold only the permissions their role requires, and access should end when their role does.
Security as stewardship
It is tempting to view cybersecurity as a technical concern, separate from mission. I would suggest the opposite. Donors entrust us with their generosity, and the people we serve entrust us with their information. Protecting both is an act of stewardship as fundamental as any other.
This article is commentary and personal reflection, not news reporting. Facts and figures are drawn from the publicly available sources listed below; the views expressed are the author’s own.
Put these ideas to work
If an article resonated, let’s talk about what it could mean for your organisation.
Start a conversation