The four things that stop almost everything
Nonprofits are attacked for the same reason anybody is: the attacker found an email address and a password that still worked. Almost nothing that happens to small organizations is sophisticated.
1. Multi-factor authentication, on everyone
Not on the executives. On everyone, including the volunteer who logs in twice a month, because an attacker does not need an important account — they need any account, and then they are inside your address book writing convincing emails.
This single measure stops the overwhelming majority of account takeovers. It is included in licenses you already have.
2. Conditional access
Rules about where and how someone can sign in. A sign-in from a country you do not operate in, on a device nobody has ever seen, at three in the morning, should be challenged or blocked. This is configuration, not a product you buy.
3. Backups you have actually restored
A backup you have never restored is a belief, not a backup. We test them, which sometimes means discovering that the nightly job has been failing silently since a server was rebuilt two years ago. Better to find that out on a Tuesday than on the morning something is encrypted.
Microsoft 365 is not backed up by Microsoft in the way most people assume. Deleted is deleted after the retention window.
4. Phishing simulation
Send your staff a realistic fake before a real one finds them. You learn who clicked, and they learn what one looks like, with no consequences attached. We name nobody to anybody but you.
We run one free before you are a customer — see free phishing simulation for nonprofits.
What we do not recommend
Buying a security product to solve a configuration problem. Most small organizations we audit are already paying for tooling they have not switched on, in licenses they already hold.