Industries

Cyber security for charities

Managed cyber security for charities. Protect donor and beneficiary data, stop fraud aimed at your funds, and meet what trustees, funders and the Charity Commission expect, on a charity's budget.

Talk to us

Why charities are targeted

Charities hold information people trust them with: donor details, gift aid records and, often most sensitive of all, information about the people they help. Many also handle money from grants and donations, with small teams, volunteers and shared accounts.

Criminals know that. In the government's Cyber Security Breaches Survey 2025/26, 28% of charities reported a cyber breach or attack in the past year, most often phishing.

What we see

Phishing and fake requests

Emails pretending to be from a trustee, a funder or a supplier, asking for a payment, a gift card or a password. Small teams and volunteers are easy to rush.

Donation and grant fraud

An attacker in a mailbox changes the bank details on an invoice or a grant payment, and the money is gone before anyone notices.

Sensitive beneficiary data

Records about vulnerable people, safeguarding notes and health details. A breach harms the people you exist to help, and may need reporting to the ICO and the Charity Commission.

Shared accounts and personal devices

Volunteers and staff using their own phones and laptops, and logins shared between several people, make it hard to know who has access to what.

What clients, insurers and regulators expect

  • Trustees and the Charity Commission. Trustees are responsible for protecting the charity's assets and data. In England and Wales they must report serious incidents to the Charity Commission promptly, and that includes a significant data breach or loss, and fraud or cyber-crime.
  • UK GDPR. Your charity is responsible for the personal data it holds about donors, volunteers and beneficiaries. A breach that puts people at risk must be reported to the ICO within 72 hours of you becoming aware of it.
  • Funders and partners. Grant makers and the organisations you work with increasingly ask how you protect data before they fund or share information with you.
  • Insurers. Charity and cyber insurers ask about multi-factor authentication, email security and device protection.
What we recommend

Protection for charities

From£4

Email security

Filters phishing, impersonation and fake payment requests out of your mailboxes before staff and volunteers see them.

Per user, per month, excluding VAT.

More details
From£8

Identity threat detection (ITDR)

Spots stolen passwords and suspicious Microsoft 365 sign-ins, so a hijacked account is caught early.

Per user, per month, excluding VAT.

More details
From£6

Anti-malware & ransomware protection

Antivirus and anti-ransomware on every laptop and desktop, a sensible starting point on a tight budget.

Per user, per month, excluding VAT.

More details
From£4

Phishing simulation & training

Practice phishing emails and short training, for staff and volunteers alike.

Per user, per month, excluding VAT.

More details
From£3

Mobile device management

Keeps charity data on personal phones under control, and removes it when a volunteer moves on.

Per user, per month, excluding VAT.

More details

Business email compromise

If a mailbox is compromised, we lock the attacker out, find out what they saw and help you contact the right people quickly.

More details

How we work with charities

Many charities have a small team, a mix of staff and volunteers, and nobody whose job is security. Budgets are tight, so we start with the protection that stops most attacks and build from there.

We start with a conversation about how your charity works: where donor and beneficiary data lives, who uses which devices, and what your funders and insurers ask for. Then we recommend the protection that fits, with prices up front. Everything runs from one platform with one monthly invoice, and you can add to it as you grow.

Questions
Start with the basics that stop most attacks: multi-factor authentication on every account, email security and antivirus on every device. Our device protection starts at £6 per user per month, excluding VAT. Our guide, How to spot a phishing email, is free to share with your volunteers.
In England and Wales, trustees must report a serious incident promptly, and that includes a significant data breach or cyber-crime. A personal data breach may also need reporting to the ICO within 72 hours. Our guide, Do we need to report a cyber attack?, explains the ICO side.
It can be, but it is manageable. A work profile keeps charity email and files separate from their personal apps and can be removed when they leave. Our guide to staff phones and BYOD explains the options.
Where to go next

< Back to Industries

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.

Talk to us
or
See every security area

Our experts spent 20 years at Sophos and include a certified ethical hacker.
More about us

Get Protected Ask a question