"This report reveals a notable rise in perceived cybersecurity risk within the nonprofit sector, with 70% of organizations reporting an increased cyber risk profile in 2025, up from 51% in 2024. Encouragingly, confidence in managing these risks has also improved, with 56% of organizations feeling confident in their cybersecurity posture, up from 45% in the previous year. The cyber threat landscape has become more diverse and frequent. Credential-based attacks – particularly phishing – have surged, affecting 94% of organizations, while financial fraud impacted 45%. Additionally, insider threats and emerging risks such as mercenary spyware have also surfaced. This multifaceted threat landscape underscores the need for layered defense strategies and a strong culture of cyber resilience.
Attribution capabilities remain limited. Over three quarters (77%) of global nonprofits are unable to attribute attacks to specific threat actors. Among those who can, common adversaries include hacktivists, government-linked entities, and criminal networks. Improving attribution through shared training, intelligence sharing, and collaborative frameworks is critical. In 2025, over half of respondents (53%) reported experiencing a security breach or other critical data incidents. This is a decline from 65% in 2024. In addition, the percentage of organizations reporting no such incidents rose to 40% in 2025, up from 29% in the previous year. While these trends indicate progress in cybersecurity resilience, the broader risk environment remains a serious concern." (Conclusions, page 6)