Earlier this month we said to verify payment changes by voice. That works well, right up until the person who would have made the call is new, or busy, or junior enough not to want to question an invoice from a long-standing vendor. A habit protects one person. A written rule protects the organization. What … Read more
For about twenty years, we taught people to spot phishing by its mistakes. Misspelled words, odd phrasing, a greeting that didn’t sound like anyone you know. That tell is gone. What changed AI tools can now write a clean, professional, well-formatted email in seconds. They can match an organization’s tone using nothing more than what … Read more
It usually looks completely ordinary. A short message from the executive director, sent to whoever can move money: “Are you at your desk? I need you to take care of something before this afternoon’s meeting. Don’t loop in the team yet.” There is nothing alarming in it. That is the point. Four things that show … Read more
An email lands from a name you know. Your board chair, your bank, your executive director. Before you have read a word of it, you have already relaxed a little. That small moment of trust is what this kind of attack is built on. The name is just a label The name you see at … Read more
If you do only one thing this month, turn on multifactor authentication. We will say that more than once. But MFA is not one thing, and the version most organizations switch on is weaker than people assume. The ladder From least to most protective: The first three share one weakness. In each, something human can … Read more
Every nonprofit has one. A spreadsheet called Logins. A shared note. A sticky on a monitor. Or the version where the executive director is the spreadsheet and everyone texts her. It persists for a reason, and it’s not laziness. The problem isn’t memory. It’s sharing. Most advice about password managers talks about remembering passwords. That … Read more
Most of us learned the same password rules: at least eight characters, a capital, a number, a symbol, and change it every ninety days. Nearly all of that advice has since been retired — and the part most people skipped turns out to be the most important. What actually goes wrong Attackers rarely guess passwords. … Read more
We hear some version of the same sentence from nearly every nonprofit we talk to. We’re small. There’s no pile of money sitting here. Who would bother with us? It’s a reasonable thing to believe. It is also the most expensive assumption in the sector, and the reason is simpler than most people expect. Nobody … Read more