Cybersecurity for Nonprofits and Foundations

Few are required to by law, but many are asked: by insurers at renewal, by payment providers, by health and government partners, and by funders who expect reasonable safeguards for the data their grants pay to collect. A test is also the fastest way to find the exposed login or the forgotten volunteer account before an attacker does. If you have never tested anything, a validated vulnerability scan from $1,500 is a low-cost first look.

The techniques are the same, and so are the prices. The priorities differ. Nonprofits hold donor records and giving pages, program data collected for funders, and accounts shared with volunteers and board members, and the report usually has to satisfy a board and a funder rather than a customer. Our small business penetration testing page covers the general approach for small teams.

Sometimes, but confirm before you budget on it. FEMA’s Nonprofit Security Grant Program, for nonprofits at high risk of terrorist or other extremist attack, listed cybersecurity measures alongside security planning and training among allowable costs in fiscal year 2025. Whether a penetration test qualifies depends on the current notice of funding opportunity and your state administering agency. For program and operating grants, ask your program officer whether security testing can be charged to the award.

Email, because it carries payment instructions and donor files, and it is the first thing an attacker phishes. A phishing campaign from $3,600 and a Microsoft 365 or Google Workspace security assessment from $4,200 cover the most common losses. Add an external test from $4,200 if staff connect remotely, and a web application test from $5,200 if you run your own donation or member portal. Each price is fixed in writing before work starts, the penetration tests include a free retest, and every starting price is listed on our pricing page.

Yes. We test the roles, sharing rules, and integrations of donor CRMs from each staff and volunteer role, and look for bulk exports and connected apps with more access than they need. Organizations running Salesforce can scope a dedicated Salesforce penetration test. We test your configuration and customizations, not the vendor’s own platform.

They are the finding most specific to nonprofits. Volunteers, interns, and board members often receive access for one event or one term and keep it, sometimes on a personal email address or a shared password passed from one cohort to the next. We list every account that can reach donor, client, or finance data, check which ones belong to people who have left, and test whether MFA covers them. The fix is usually a joiner and leaver checklist tied to the volunteer coordinator’s roster.

Yes, at the same fixed prices. Email, web, and external testing run remotely, and internal tests run through a small device we ship to your office. We meet organizations in person across the five boroughs and in Westchester, and work with associations and nonprofits in Washington, DC remotely, with on-site visits by arrangement.