For years, many nonprofits got cybersecurity help they never signed up for: warnings about new scams, advisories on active threats, and free guidance written for organizations without an IT department. Much of it came from federal programs like CISA and the MS-ISAC, and it trickled down through state agencies, funders, and peer networks.

That pipeline is thinning. The administration has proposed cutting CISA’s budget by roughly $700 million, and federal funding cuts have pushed many state and local governments out of the MS-ISAC. Nonprofits were never full members of that system, but plenty relied on what it produced. Meanwhile, nonprofits across Massachusetts are still absorbing federal funding cuts, with tighter budgets and stretched staff.

So the question for the next few years isn’t only “are we secure?” It’s “who tells us when something is coming?”

Attackers are getting better at what nonprofits are most exposed to

Most nonprofit breaches don’t start with sophisticated hacking. They start with trust. A grant manager gets an email from the “executive director” asking for a quick wire. A finance lead receives a vendor’s “new banking details.” These requests work because they look familiar, come from people an organization knows, and create pressure to act quickly.

What makes them harder to spot is how convincing they’ve become. AI tools can write polished, personal emails in seconds and clone a voice from a short clip of a recorded webinar or podcast. The old advice to watch for typos and awkward phrasing no longer holds up. Your ED’s voice on a voicemail is no longer proof it’s your ED. And the threat is growing: Infosecurity Magazine recently reported a 35% rise in email threats aimed at nonprofits.

Build your own early warning system

The strongest defenses here are cheap. They’re habits more than products.

  • Agree on a verification rule now. Any request to move money, change payment details, or share credentials gets confirmed through a second channel, like a call to a known number. Leadership should say out loud that they want to be double-checked, so staff never feel awkward doing it.
  • Make reporting the easiest thing in the building. Provide one place to forward anything suspicious and say thank you every time. The staff member who flags a strange email in five minutes is your alert system now.
  • Talk to your peers. The federal alerts may be quieter, but your network isn’t. A quick note to peer organizations when a scam hits you is the community version of what the MS-ISAC used to do.
  • Lock the front doors. Use multi-factor authentication on email, file storage, and your donor database, and keep a written offboarding checklist so former staff accounts don’t linger.
  • Name an owner. Someone should be accountable for security, even for an hour a week. Without one, it defaults to whoever is most worried that week.

CTS has been helping mission-driven organizations stay focused on what matters since 2010. Whether you need a partner to manage IT from end-to-end or an extra layer of expertise alongside your existing team, we’re here to help you stay ahead of threats, protect your people and data, and keep technology from getting in the way of your mission.

If you’re curious where your organization stands, let’s talk. We’ll give you an honest perspective on your cybersecurity posture and where you may need to strengthen it. Contact us here.



About the Author: Jim Levine is a Principal Consultant with CTS.