In 2025, aid budgets fell further than they ever had, and the people trying to break into NGO networks didn’t scale back with them. Fewer staff and older laptops make rights groups, humanitarian agencies and independent newsrooms easier targets at the moment they can least afford a breach. Here’s where the risk sits, which protections cost little or nothing, and how small teams can get serious security without a full IT department.
The Money Fell. The Targeting Didn’t.
OECD preliminary data released in April 2026 shows official development assistance fell 23.1% in real terms from 2024 to 2025, the largest annual decline ever recorded. For NGOs, that meant frozen grants, closed field offices and smaller teams.
Attackers kept their focus. Microsoft’s Digital Defense Report 2025 places think tanks and NGOs among the three sectors state-affiliated hackers target most. They account for 13% of Russian activity, 9% of Chinese activity and 8% of North Korean activity.
Microsoft’s explanation is blunt. NGOs, like many government and academic institutions, “operate on legacy systems that are difficult to patch and secure, and have small IT teams with limited incident response capabilities.” That combination makes them high-value targets for spies and criminals alike.
What Attackers Want From a Nonprofit
An NGO rarely holds money worth stealing. It holds something more useful: names. Beneficiary lists, the identities of sources, the whereabouts of activists, donor records and reports that some governments would rather never see published.
For a rights group documenting abuses, one compromised inbox can expose people who trusted it with their safety. For a humanitarian agency, ransomware can freeze registrations and cash transfers for families who depend on them that week.
The way in is usually ordinary. The UK government’s Cyber Security Breaches Survey 2025 found that 30% of UK charities had a breach or attack in the previous 12 months, and phishing featured in 86% of those cases. A convincing email still beats a firewall.
Five Protections That Cost Almost Nothing
Good security starts with habits, not purchases. These five close the common ways in:
- Multi-factor authentication everywhere. Start with email, then cloud storage and finance systems. A stolen password alone stops being enough.
- Automatic updates. Switch them on for operating systems, browsers and phones. Machines too old to receive updates should come off the network.
- Offline backups. Keep at least one copy that ransomware can’t reach, and test a restore every quarter.
- Same-day offboarding. When staff or volunteers leave, their accounts close that day. Funding cuts bring more departures, and every forgotten account is an open door.
- Phishing practice. Short, regular exercises teach more than one annual slide deck.
The major email and cloud platforms include these features, often at nonprofit rates. The cost is mostly staff time, and it’s small next to the cost of a breach.
Shared IT Support Instead of a Full Department
A dedicated security team is out of reach for a 15-person organisation. A shared one isn’t. The same UK survey found that 27% of charities already work with an external cyber security provider.
Managed IT providers look after many small organisations at once. They install a monitoring agent on every laptop and server, watch for problems from one screen, and push security updates on a schedule. It works the same whether the laptop sits in Geneva or in a field office with a patchy connection.
That software category is called remote monitoring and management. When comparing providers, ask which RMM tools they run, how fast they patch critical vulnerabilities, and whether they can reach devices that only come online once a week.
Ask who can see your data, too. For organisations protecting sources or activists, a provider’s access is part of the threat model. The contract should state where data lives and who can touch it.
Open Source Stretches a Small Budget
Licence fees grow with every person and device an organisation adds. Open-source software takes that line off the budget. Free, community-maintained tools now cover email filtering, password management, remote support and security monitoring.
Wazuh is one example. It collects logs from every machine, flags suspicious activity and checks systems against security baselines, with no licence fee. The trade-off is skill: someone has to install, tune and maintain it. A side-by-side look at open-source SIEM and commercial platforms shows where that trade pays off and where it doesn’t.
Open source also answers a question many NGOs now ask: who controls the infrastructure? Self-hosted tools keep sensitive data on servers the organisation chooses, in a jurisdiction it chooses.
Where Donors Fit In
Security spending usually lands in the overhead line that donors want kept small. For organisations holding sensitive data on vulnerable people, that’s the wrong place for it. Funding baseline security as a programme cost protects the programme.
Pooled models help as well. Donors can fund shared security services across a group of grantees, so a small rights group gets the same monitoring as a large agency. Volunteer schemes such as the CyberPeace Institute’s CyberPeace Builders already pair NGOs with security professionals from partner companies.
Smaller Budgets, Same Duty of Care
The 2025 aid cuts forced hard choices across the sector. Security shouldn’t be one of them, because the people an NGO serves carry the cost of a breach. Put the five free protections in place this month, then decide whether shared support or open-source tooling fills the gap a full IT team used to cover.
