In the first part of this annual check-in, Carolyn Woodard and Matthew Eshleman dive into the findings from the eighth annual Nonprofit Cybersecurity Incident Report. Analyzing data from thousands of client endpoints throughout 2025, they discuss how the landscape has shifted—specifically how AI is being used by threat actors to lower the barrier for sophisticated attacks. This episode provides a high-level look at the trends that defined the past year and the foundational layers every nonprofit needs to protect its mission in 2026.

The conversation covers the rise of financially motivated scams, the increasing frequency of partisan digital attacks, and why data is transitionally moving from an organizational asset to a potential liability. Matthew explains:

How AI tools are accelerating attack vectors through automated scripts and convincing phishing.
Why your organization’s cybersecurity foundation must be built on policy and frequent, vibrant staff training rather than just annual videos.
The evolution of multi-factor authentication (MFA) and the shift toward phish-resistant methods like Passkeys or physical keys like FIDO keys.
Why data retention policies are becoming a necessity to mitigate legal risks and data leakage.
The importance of governing how staff interact with free AI tools to prevent institutional data from entering the public domain.

Resources Mentioned

_______________________________
Start a conversation :)

Register to attend a webinar in real time, and find all past transcripts at https://communityit.com/webinars/
email Carolyn at cwoodard@communityit.com
on LinkedIn
on reddit/r/nonprofitITmanagement
on the Community IT website

Thanks for listening.

2026 Nonprofit Cybersecurity Incident Report with Matthew Eshleman pt 1