Insights

The most important security system in your organization is not a product. It is your people.

Firewalls, filters, and endpoint protection matter—but the most consequential security decisions in your organization are made by people. A volunteer opening an email. A finance administrator responding to an urgent request. A staff member choosing a password. Technology can reduce risk, but it is people who either stop an attack or let it through.

That is not a weakness to lament. It is an opportunity to invest in. Research consistently shows that the overwhelming majority of successful breaches begin with a human moment: a convincing phishing message, an impersonated leader, a manufactured sense of urgency. Attackers understand people. Defenders must understand them better.

Why Mission-Driven Organizations Are Targeted

Churches, nonprofits, and community organizations run on trust. Members and donors expect quick responses. Leaders are publicly visible, and their names, photos, and schedules are often published online. Attackers exploit exactly these strengths—sending gift card requests that appear to come from a pastor, or wire transfer instructions that appear to come from a director. The message succeeds not because your people are careless, but because they are helpful.

Turning People Into Guardians

The answer is not fear—it is formation. When people understand how these schemes work, recognition becomes reflex. Practical steps include:

• Regular, relevant awareness training — short, engaging sessions tailored to congregations, staff, and volunteers, not generic corporate modules.
• Verification habits — a simple rule that any unusual request for money, gift cards, or credentials is confirmed by phone or in person before acting.
• Phishing simulations — safe practice runs that build vigilance against business email compromise and impersonation attempts.
• A no-blame reporting culture — people who suspect they clicked something wrong should feel safe reporting it immediately, because minutes matter.

Security as an Extension of Care

In our work with faith-based and mission-driven organizations, we frame security awareness as stewardship: protecting the people and resources entrusted to you. When training is delivered in that spirit, it stops feeling like an IT requirement and starts feeling like part of the mission itself.

Trust is your greatest asset—and the very thing attackers try to exploit.

Faith-based and nonprofit organizations hold some of the most sensitive data in any community: member and donor records, giving histories, counseling notes, benevolence requests, and the personal details of children and vulnerable adults. Yet many operate with limited budgets, volunteer-run technology, and no dedicated security staff. Attackers know this—and increasingly act on it.

The Threats We See Most

• Leadership impersonation scams — emails or texts pretending to be a pastor, executive director, or board chair, urgently requesting gift cards or wire transfers.
• Business email compromise — attackers gaining access to a real mailbox and quietly redirecting payments or donation flows.
• Ransomware — locking up member databases, accounting systems, and years of ministry records until a payment is made.
• Donor data exposure — weakly secured platforms leaking the very information supporters trusted you to protect.

Practical First Steps

Enterprise-grade protection does not require an enterprise budget. Based on our doctoral research with faith communities, we recommend starting here:

• Turn on multi-factor authentication everywhere it is offered—email first, then giving and accounting platforms.
• Know your data — inventory what you hold, where it lives, and who can access it; then remove access no one needs.
• Adopt a few core policies — acceptable use, data protection, and incident response, written in plain language people will actually follow.
• Establish verification rules for money — no gift cards, wire transfers, or banking changes on the strength of an email alone.
• Back up what matters — and test that you can actually restore it.
• Vet your vendors — the platforms handling your donations and member data are part of your security posture.

A Staged Path Forward

Our Securing Sacred Spaces™ engagement was built for exactly this journey: assessment, a guidebook roadmap, policy implementation, and ongoing advisory—organized around People, Process, and Technology so improvements are sustainable, not one-time fixes.

Security is not an IT problem. It is a leadership responsibility.

Cybersecurity is no longer a technical specialty delegated to whoever manages the computers. It is a leadership discipline—a matter of governance, stewardship, and organizational resilience. The organizations that weather today's threat landscape are not the ones with the most expensive tools; they are the ones whose leaders treat security as part of how the mission is protected and advanced.

What Cyber Leadership Looks Like

• Ownership at the top — boards and executive teams that ask about cyber risk with the same seriousness they bring to finances and safety.
• Clear accountability — someone is responsible for security, with the authority and support to act, even in a small organization.
• Risk-informed decisions — understanding which data and systems matter most, and directing limited resources there first.
• Preparation before crisis — an incident response plan that has been practiced, so the first tabletop exercise is not the real thing.
• A culture of vigilance — leaders who model good security habits give everyone else permission to take them seriously.

Questions Every Board Should Ask

Governance does not require technical depth—it requires the right questions: What data do we hold that others would want? What would a three-day outage cost our mission? When were our backups last tested? Who would we call first in an incident? What are our vendors doing with our data? If those questions have no answers, that is the starting point.

Resilience Over Perfection

No organization prevents every incident. The goal of leadership is resilience: reducing the likelihood of a breach, limiting its blast radius, and recovering quickly enough that the mission continues. That mindset—steady, prepared, accountable—is what transforms cybersecurity from a source of anxiety into an act of stewardship.

Every new tool asks the same question: does it serve the mission, or put it at risk?

Artificial intelligence has arrived in the daily life of mission-driven organizations—drafting newsletters, answering questions, summarizing meetings, and powering the platforms you already use. It brings genuine promise for stretched teams. It also brings new risks that arrive dressed in familiar clothing. Wise adoption requires seeing both clearly.

The Promise

Used well, AI gives small teams hours back: administrative drafting, communication support, translation and accessibility, research assistance, and streamlined operations in tools like Microsoft 365 and Google Workspace. For organizations where every staff hour is precious, that time returns directly to the mission.

The Peril

• AI-enabled impersonation — voice cloning and deepfakes make the classic "pastor needs gift cards" scam dramatically more convincing; a familiar voice on the phone is no longer proof of identity.
• Sharper phishing — AI-written messages are fluent, personalized, and free of the telltale errors people were trained to spot.
• Data leakage — member, donor, and pastoral information pasted into unapproved AI tools may leave your control entirely.
• Misplaced trust — AI-generated content can be confidently wrong, and publishing it unchecked puts your credibility at stake.

Adopting AI as Stewardship

The same framework that guides sound cybersecurity guides sound AI adoption:

• People — build AI literacy so leaders, staff, and volunteers understand what these tools are, what they are not, and how criminals misuse them.
• Process — set a responsible use policy: which tools are approved, what data may never be entered, and how AI-assisted content is reviewed. Strengthen verification rules so money never moves on the strength of a voice or an email alone.
• Technology — evaluate AI vendors and features with the same rigor as any system that touches your data, and configure the AI capabilities in your existing platforms deliberately rather than by default.

AI is neither savior nor threat—it is a tool. Approached with wisdom, guardrails, and mission-first purpose, it can serve your work while your people stay protected.