Security awareness¶

Security awareness in a non-profit is a different problem from security awareness in a corporate environment. The population is more diverse: paid staff alongside volunteers who may range from retired professionals to school-age helpers. The communication channels are less uniform. The authority to compel participation is weaker. The budget for professional training platforms is usually limited.

None of this is an excuse for not doing it. Phishing and social engineering are the most common routes into non-profit organisations, and they work primarily because people do not recognise them. That is a solvable problem, at least partially, and solving it does not require an enterprise training budget.