We hear some version of the same sentence from nearly every nonprofit we talk to. We’re small. There’s no pile of money sitting here. Who would bother with us?
It’s a reasonable thing to believe. It is also the most expensive assumption in the sector, and the reason is simpler than most people expect.
Nobody picked you
The mental picture behind “we’re too small to be a target” is a person — someone sitting somewhere, looking down a list of organizations, deciding which one is worth their time. If that were how it worked, small nonprofits really would be safe. Nobody with a choice would pick the food pantry over the bank.
That is not how it works.
Almost everything that reaches your inbox arrived because a machine found you, not because a person chose you. Scripts crawl the internet looking for login pages, unpatched software, and email addresses. They try the same thing against ten thousand organizations an hour and keep whichever doors open. Your budget never enters the calculation. Neither does your cause. The only question the script asks is whether the door moved.
So the useful word is not target. It is reachable.
What makes a nonprofit reachable
Once you change the word, the picture gets clearer — and a little less comfortable.
Money moves through you. Grants, donations, payroll, vendor payments, reimbursements. An organization that regularly sends money to new recipients is an organization where one convincing email can redirect a payment.
Your data is rich. Names, addresses, giving histories, and often details about the people you serve that are far more sensitive than anything a small business holds.
Your team is built to be open. Nonprofit staff answer strangers, open attachments from applicants, and click links from partners they have never met. That is not carelessness. That is the job.
And in most organizations your size, nobody’s entire role is watching for this. It gets absorbed by an operations manager, a finance director, or whoever is handiest with a computer.
None of that makes you a target. All of it makes you reachable.
This is not theoretical
Abnormal Security, which analyzes email traffic across thousands of organizations, reported in early 2025 that email-based attacks on nonprofits had risen 35.2% year over year, with credential phishing — the kind that steals a login and opens the donor database behind it — up 50.4%. Those are figures about this sector specifically, not general business numbers scaled down. (reported by Infosecurity Magazine)
The good news is real
Here is the part that gets lost. Because the attacks are automated and indiscriminate, the defenses that stop them are ordinary and unglamorous. You are not being outmaneuvered by a specialist who studied your organization. You are being scanned by a script, and scripts move on when the easy path closes.
Turning on multifactor authentication closes most of it. So does a habit of confirming payment changes by phone. So does letting updates install. None of these need a security department, and most of them are already sitting switched off inside tools you have.
What’s coming this month
Through October we’re publishing fifteen short pieces, one topic at a time, written for organizations with no IT department. No jargon, no scare tactics, and one concrete thing to do at the end of each one.
We’ll cover multifactor authentication, the shared-password problem, phishing for teams trained to be helpful, the scam aimed squarely at executive directors, offboarding, backups, updates, board members’ laptops, vendors, AI tools, insurance, and what to do in the first hour of an incident.
Start with something you can hang on a wall
We made a one-page reminder sheet you can print and put up in your office. Six habits, large enough to read from across the room, with a QR code back to this series.
↓ Download the Cybersecurity Awareness Month poster (PDF)
Print it, hang it by the printer or the coffee maker, and you have already done more than most organizations will do this month.
Next, on Friday: what you’re actually protecting, and why a one-page inventory of where your donor data lives is the thing everything else depends on.