Resilience in Uncertain Times: Cyber Security Guidance for Purpose-Driven Organizations
Current Threat Landscape for Purpose-Driven Organizations
As we navigate unprecedented times of economic and geo-political pressures, teams are more susceptible to social engineering attacks targeting our basic human instincts. Most things that affect an organization are cyclical. Whether it’s the economy, buying patterns, which political party is in power, you can count on things that come and go. When it comes to information security, threats are not cyclical but continue to increase. Organizations also face attacks of increasing sophistication.
This growing and evolving threat landscape affects all, but those in purpose-driven sectors face a unique set of cybersecurity challenges. In a world of increasing geopolitical tension, economic uncertainty, and rapidly evolving cyber threats, purpose-driven organizations are navigating more than just mission delivery—they’re defending trust. Due to the nature of their work, these teams are susceptible to hacktivist campaigns, state-sponsored attacks, and social engineering attacks designed to manipulate non-profits and fundraising. Why is this sector facing increasing risks? Reasons include:
- Valuable data like donor and beneficiary information
- Smaller IT teams and budgets increasing exposure to phishing, ransomware, and vendor breaches
- High-stakes outcomes—disruptions mean missed funding, broken trust, and halted programs
In their 2025 report on cybersecurity in nonprofits, BDO cites a 30% year-over-year increase in cyberattacks on nonprofits.
The following are some real-world examples of recent attacks targeting purpose driven organizations:
The Business Case for Cyber Resilience
Resilience is more than a shopping cart of controls and is baked into an organization’s culture. For winning organizations, resilience includes the following attributes:
1. Knowing What’s Critical
Resilient organizations take the time to identify which systems, data, and services are most vital. Whether it’s a donor CRM, case management platform, or volunteer scheduling system, knowing what matters most allows teams to focus limited resources on the biggest risks.
2. Defense-in-Depth
A resilient approach balances security and usability, implementing tools and controls that fit your size, budget, and culture. It also includes layering these controls so that a failure of one control is mitigated by another, complementary control. For example, a compromised password can be mitigated by a multi-factor authentication (MFA) challenge.
3. Resilient People
Resilient organizations treat cybersecurity like safety training. Every team member has a baseline understanding of risks affecting the organization, common controls to address these, and how best to respond to incidents. That means everyone, including:
- volunteers, contractors to full-time employees
- people working in front-line nonp-profit roles to executive management
- IT people to non-technical folks
Resilient people know how to:
- spot suspicious emails,
- use strong, unique passwords
- how to report incidents and to whom
4. Practiced Response and Recovery
No defense is perfect. Resilience means you’re prepared to respond and bounce back. This starts with an incident response plan. Next is gathering a team together who are practiced in working the plan should the unthinkable happen. Finally, having basic incident response tools in place such as backups, alternate communication methods (say, beyond your primary email system), and cyber-liability insurance providers increases the organization’s ability to recover from an incident.
5. Continuous Improvement
To borrow from the agile technology movement, blame the process not the person. Resilient organizations take every opportunity to learn from incidents and close-calls. This learning results in continuous learning and improvement. Formal incident retrospectives where the team goes over what went well and what could be improved should be a part of normal operations. Less formal incident response check-ins that happen off-cycle will also work this continuous improvement muscle. For example, teams can make a habit of asking “what if” scenario questions in meetings that aren’t solely dedicated to incident response. For example, one of our clients had a Finance team probe the company’s backup and recovery capabilities at the end of a management team meeting.
Resilience is a journey—not a destination.
Conclusion
Purpose-driven organizations operate in complex, often high-stakes environments—where trust, impact, and continuity matter more than ever. Cyber resilience isn’t just a technical imperative; it’s a strategic one.
While the threats are real and growing, resilience is well within reach. It doesn’t require perfection or a Fortune 500 budget. It requires clarity on what matters most, a commitment to building capacity across your team, and a willingness to improve continuously.
At Betterleg Studios, we believe that every nonprofit and social enterprise deserves to feel confident in their ability to protect their mission. Resilience isn’t about avoiding every threat—it’s about being ready, responsive, and adaptive when challenges arise.
Because in uncertain times, it’s not just about weathering the storm. It’s about emerging stronger.
