Adversary Aware: Cybersecurity for Charities

Course introduction

Cyber attacks rarely begin with a brilliant piece of code.

They begin with information, trust, and a request that feels ordinary.

A charity may hold money, personal information, confidential records, access to important services, and the trust of the people it supports. It may also depend on busy staff, volunteers, trustees, suppliers, and partner organisations working together across different systems.

To an attacker, that creates opportunity.

This course examines cyber security from the attacker’s point of view. It explains how adversaries choose targets, gather information, create convincing approaches, obtain access, and turn one successful action into wider harm.

The purpose is not to make everyone suspicious of everything.

It is to help you recognise when a normal-looking interaction deserves a pause, understand why common security controls exist, and know what to do when something feels wrong.

Who this course is for

This course is intended for:

• Charity staff.
• Volunteers.
• Trustees.
• Fundraisers.
• Administrators.
• Finance teams.
• Communications teams.
• Service-delivery staff.
• Anyone who uses an account, handles information, communicates with the public, or makes decisions on behalf of a charity.

No technical knowledge is required.

What you will learn

By the end of this course, you should understand:

• Why charities can be attractive targets.
• The main forms of cyber attack and cyber-enabled fraud charities encounter.
• How an attacker moves from choosing a target to creating harm.
• How public information can be reused to make an attack convincing.
• How social engineering manipulates normal human behaviour.
• Why passwords are attacked, stolen, and reused.
• Why email accounts are particularly valuable to attackers.
• How passkeys, password managers, and two-step verification reduce risk.
• How ordinary working processes can interrupt an attack.
• What to do before and after a suspicious action.
• Why fast, blame-free reporting is a security control.

A principle for the entire course

You are not expected to identify every attack perfectly.

Some fraudulent messages are obvious. Others are carefully researched, technically convincing, and designed to resemble the ordinary work of your organisation.

Security should not depend on every person spotting every deception.

It should provide safe ways to pause, verify, report, and recover when deception succeeds.

1. The charity threat picture

A charity does not need to be wealthy, famous, or technically sophisticated to attract malicious attention.

Some attacks are targeted. An attacker chooses a particular organisation, studies it, and constructs an approach around its people and processes.

Many attacks are opportunistic. An attacker sends the same lure to thousands of organisations and waits for one person, account, or process to respond.

A small charity can therefore be attacked for two apparently opposite reasons:

• Because an attacker knows something specific about it.
• Because attacking it costs the attacker almost nothing.

What an attacker may want

To an attacker, a charity can be several things at once.

A wallet

Charities receive donations, pay suppliers, reimburse expenses, manage grants, and move money between accounts.

An attacker may try to:

• Redirect a payment.
• Replace genuine bank details.
• Impersonate a supplier.
• Submit a false invoice.
• Take over an online banking or finance account.
• Persuade someone to purchase gift cards or transfer funds.

A database

Charities may hold information about:

• Beneficiaries.
• Donors.
• Employees.
• Volunteers.
• Trustees.
• Supporters.
• Partner organisations.
• Health, financial, safeguarding, or other sensitive circumstances.

This information can be stolen, sold, leaked, used for extortion, or reused in further attacks.

A trusted disguise

A charity’s name can make a fraudulent message appear safe.

An attacker who compromises or convincingly imitates a charity may approach:

• Donors.
• Beneficiaries.
• Suppliers.
• Staff.
• Volunteers.
• Partner organisations.
• Members of the public.

The attacker is not only stealing the organisation’s technology. They are borrowing its reputation.

A route into somewhere else

A charity may share information, systems, documents, and trusted relationships with:

• Local authorities.
• Health providers.
• Schools.
• Solicitors.
• Accountants.
• Technology providers.
• Funders.
• Community groups.
• Other charities.

An attacker may target the charity because its accounts or relationships provide a more convincing route towards somebody else.

A service that cannot easily stop

Many charities deliver services people genuinely depend upon.

An attacker may assume that disruption will create pressure to:

• Pay quickly.
• Restore systems without proper investigation.
• Bypass normal controls.
• Continue working through unsafe channels.
• Accept an attacker’s claimed solution.

This is one reason resilience matters. The ability to continue operating reduces the attacker’s leverage.

What UK charities reported

In the UK Government’s Cyber Security Breaches Survey 2025/2026:

• 28% of charities reported identifying a cyber security breach or attack during the previous 12 months.
• This was estimated to represent approximately 57,000 registered charities.
• 25% of all charities reported phishing attacks.
• Among charities that identified a breach or attack, 87% experienced phishing.
• 69% of charities that identified a breach or attack regarded phishing as their most disruptive type of attack.
• Among charities that identified a breach or attack, 26% said they experienced breaches or attacks at least weekly.

These figures describe incidents charities identified. They do not include attacks that were never detected, recognised, or reported.

They also do not mean that every reported phishing message resulted in compromise. An attempted attack is still useful evidence because it reveals how charities are being approached.

Source: Cyber Security Breaches Survey 2025/2026, Department for Science, Innovation and Technology, published 30 April 2026.

What the figures do not say

Statistics can help us set priorities, but they should not be used to create false certainty.

The figures do not tell us:

• That every charity has the same risk.
• That every phishing message is easy to recognise.
• That phishing is the only threat worth considering.
• That an organisation which reported no incident was never attacked.
• That staff should be solely responsible for stopping attacks.

A charity’s risk depends upon its systems, information, public profile, working practices, partners, and ability to detect suspicious activity.

The useful conclusion is not that everyone should become more afraid.

It is that attackers repeatedly choose approaches built around communication, identity, and trust.

2. The attacker’s route

Most successful attacks are not a single dramatic event.

They are a sequence of ordinary opportunities.

An attacker may begin with a public staff biography, continue with a convincing email, obtain one password, enter one account, and use that account to approach somebody else.

No individual step needs to be catastrophic.

The danger comes from what the steps become when they are connected.

The Shellhex attack-chain model

A Shellhex explanatory model. This is Shellhex’s own plain-language model for explaining how attacks typically progress. It is not a formal industry framework and it is not statistical data.

1. Select

   The attacker chooses a target.

   This may be:

   • A particular charity.
   • A person with access to money.
   • Somebody with an interesting job title.
   • A public email address.
   • An organisation using a particular service.
   • Thousands of addresses gathered automatically.

   The attacker’s first decision may be careful or almost random.

2. Observe

   The attacker gathers information.

   They may look at:

   • The charity’s website.
   • Social media.
   • Staff profiles.
   • Job advertisements.
   • Public reports.
   • Trustee information.
   • Events.
   • Suppliers.
   • Email addresses.
   • Photographs.
   • Automatic replies.

   The purpose is not always to discover a secret.

   It is often to discover enough ordinary truth to make a lie believable.

3. Approach

   The attacker creates contact.

   The approach may arrive through:

   • Email.
   • A telephone call.
   • Text message.
   • Social media.
   • A messaging platform.
   • A QR code.
   • A shared document.
   • A supplier account.
   • A compromised colleague’s account.
   • An in-person visit.

4. Convince

   The attacker creates a reason to act.

   They may use:

   • Authority.
   • Urgency.
   • Fear.
   • Helpfulness.
   • Familiarity.
   • Secrecy.
   • Routine.
   • Sympathy.

   The attacker is trying to prevent the recipient from stepping outside the interaction and checking it independently.

5. Enter

   The attacker obtains something useful.

   This may be:

   • A password.
   • Approval of a login.
   • A payment.
   • A document.
   • Personal information.
   • Access to a device.
   • A telephone conversation.
   • A change to bank details.
   • A new user account.
   • A malicious application being authorised.

6. Expand

   The attacker uses the first success to gain more.

   For example:

   • An email account is used to reset other passwords.
   • A contact list is used to approach colleagues.
   • A trusted mailbox is used to send fraudulent invoices.
   • A compromised device is used to reach shared files.
   • One administrator account is used to create another.
   • A stolen document supplies information for the next approach.

7. Exploit

   The attacker creates impact.

   This may include:

   • Financial fraud.
   • Data theft.
   • Identity theft.
   • Service disruption.
   • Extortion.
   • Ransomware.
   • Public impersonation.
   • Damage to trust.
   • Attacks against beneficiaries, donors, suppliers, or partners.

4. Social engineering - hacking the decision

An attacker rarely needs to break a system.

Far more often, they only need one person to make one ordinary-looking decision.

Social engineering is the deliberate manipulation of a person’s judgement so that they take an action which helps the attacker. It does not rely on defeating software. It relies on how people make decisions under normal working conditions: quickly, politely, and with limited time to check every detail.

The attacker’s request is usually small. It rarely asks for everything at once.

Small requested actions attackers commonly seek include:

• Click one link.
• Confirm one password.
• Approve one login.
• Open one attachment.
• Reply with one piece of information.
• Change one bank detail.
• Forward one document.
• Authorise one payment.
• Install one application.

Each of these actions can look entirely reasonable in isolation. That is precisely why they work.

The exploit is not stupidity

It is tempting to assume that a person who is deceived has been careless, gullible, or insufficiently trained.

This assumption is usually wrong, and it is not a safe basis for security.

Social engineering exploits normal, adaptive human behaviour: trusting a name we recognise, responding promptly to someone senior, wanting to help a person in distress, and completing routine tasks without treating every one as a potential threat.

A well-researched approach, delivered at a busy moment, can be difficult for anyone to recognise. The people most likely to be targeted are often the most conscientious: the ones who reply quickly, want to be helpful, and take their responsibilities seriously.

The pressures attackers use

Attackers rarely invent new psychological techniques. They combine a small number of well-understood pressures, chosen to suit the target, the moment, and the request.

• Authority

  The attacker imitates or borrows a position of seniority, expertise, or institutional power, so that questioning the request feels inappropriate or risky.

  Examples: A message that appears to come from a chief executive, a trustee, a bank’s fraud team, a well-known regulator, or a supplier’s finance department.

  Defensive question: Would I still complete this action if I could not see whose name is attached to it?

• Urgency

  The attacker compresses the time available to think, discuss, or verify, so that the fastest response feels like the only reasonable one.

  Examples: A deadline of a few minutes, an account described as about to be suspended, a payment called time-critical, or a warning that a service will be lost immediately.

  Defensive question: What is the real cost of taking a few more minutes to check this?

• Familiarity

  The attacker uses names, relationships, projects, or a tone of voice that already feel known, so the message seems to come from within an existing, trusted relationship.

  Examples: A message referencing a real colleague, a genuine event, a current project, or written in language that matches how the organisation usually communicates.

  Defensive question: Does knowing a name or a project prove that this message really comes from that person?

• Fear

  The attacker threatens a loss, a consequence, or a harm, so that avoiding that outcome feels more important than checking whether it is genuine.

  Examples: A threatened data breach, legal action, a claim that an account has already been compromised, or a warning of consequences for inaction.

  Defensive question: Am I responding to a genuine risk, or to a feeling this message was designed to create?

• Helpfulness and sympathy

  The attacker appeals to a person’s instinct to help someone in difficulty, or to a caring culture that many charities deliberately cultivate.

  Examples: A “colleague” apparently stranded and asking for gift cards, a distressed beneficiary requesting urgent personal details, or a new starter asking for immediate access.

  Defensive question: Would I still help in this way if I checked through another route first?

• Secrecy

  The attacker asks the recipient to keep the request confidential, so that it cannot be discussed with a colleague who might question it.

  Examples: “Keep this between us”, “don’t mention this until it is announced”, or a request described as confidential ahead of a supposed announcement.

  Defensive question: Why would a genuine request need to bypass the people who could verify it?

• Routine

  The attacker disguises the request as an ordinary, expected part of everyday work, so it receives the same limited attention as genuine routine tasks.

  Examples: An invoice that resembles the usual supplier, a password-reset message identical in style to real ones, or a calendar invitation that fits naturally into the working week.

  Defensive question: Am I completing this because I have actually checked it, or because it looks like something I do every day?

Inspect less. Verify more.

Much traditional advice focuses on inspection: look for spelling mistakes, check the sender’s address, hover over the link.

Inspection has real limits. Sophisticated attackers write correctly, use accurate names, and register addresses which look almost identical to genuine ones. Inspection can also be impractical for people using screen readers, magnification, touch devices, or mobile applications, who may not be able to “hover” over anything at all.

A more reliable habit is verification through a route the recipient chooses, not the route the message provides.

Open the service through a route you chose, not the route the message chose for you.

5. Passwords, passkeys, and account security - when the attacker becomes you

Firewalls, antivirus software, and network monitoring are built to notice unauthorised activity.

An attacker who has obtained a genuine username and password does not need to defeat any of these defences.

To the system, they are not intruding. They are logging in.

This is why account security deserves attention in its own right, separate from the technical defences covered elsewhere in this course.

Why email is the skeleton key

Most people hold dozens of online accounts.

Almost all of them rely on the same recovery route: a message sent to an email address.

An attacker who controls your email account can typically:

• Reset the password on your banking, shopping, and social media accounts.
• Read confirmation codes and recovery links intended only for you.
• Search old messages for other passwords, documents, or sensitive information.
• Impersonate you convincingly to colleagues, friends, and family.
• Discover which other services you use, and target them next.

One compromised email account can therefore lead to many compromised accounts.

This is why email deserves the strongest protection an individual account can be given.

How attackers obtain account access

Passwords are rarely broken through pure computing power alone. Most are obtained through one of a small number of familiar routes.

Password reuse

An attacker takes an email address and password exposed in an unrelated data breach, and tries the same combination against other services. If the password has been reused, the attacker gains access without guessing or breaking anything. This technique is sometimes called credential stuffing.

Phishing

An attacker sends a message that leads to a fake or manipulated login page. The person enters their genuine username and password, and hands both directly to the attacker.

Guessing

An attacker tries common passwords, predictable patterns, or personal details such as names, dates, and pet names, often gathered from public information.

Login-approval manipulation

An attacker who already holds a password repeatedly triggers a login or two-step verification prompt, hoping the account holder approves one out of habit, frustration, or confusion, without realising it was not their own request.

Account recovery

An attacker uses the “forgotten password” or account-recovery process itself, exploiting guessable security questions, outdated recovery details, or an already-compromised recovery email address or phone number.

Malware or stolen sessions

Malicious software on a device can record passwords as they are typed, or steal an active, already-logged-in session, allowing an attacker to act as the account holder without ever seeing the password at all.

The current order of preference

First choice: passkeys

Use a passkey wherever the service and your organisation support one.

A passkey is created and managed by a credential manager on a trusted device.

It is resistant to ordinary credential phishing because it is connected cryptographically to the genuine service. It cannot simply be typed into an attacker’s imitation website and reused in the same way as a password.

The NCSC recommends choosing passkeys over passwords wherever they are available. NCSC, Passkeys: what you need to know.

Second choice: unique password and two-step verification

Where passkeys are not available:

• Use a strong password which is unique to that account.
• Store it in an approved password manager or credential manager.
• Enable two-step verification.
• Prefer an authenticator application or another stronger method where your organisation supports it.

Any form of two-step verification is generally better than none, but an unexpected approval or code request must still be treated seriously.

Human-memorable fallback: three random words

Where a person genuinely needs to remember a password rather than use a generated one, three unrelated random words can create a password which is long and easier to remember.

Do not use the following examples as real passwords:

• harbour-lantern-biscuit
• otter-copper-window
• meadow-engine-kettle

Avoid words connected to:

• The organisation.
• Family members.
• Pets.
• Addresses.
• Favourite teams.
• Birthdays.
• Public interests.
• The service being protected.

The NCSC recommends three random words as a practical method for memorable passwords and recommends password managers where appropriate. NCSC, Three random words.

Seven account rules which interrupt attackers

1. Protect email first.
2. Use a passkey where available.
3. Otherwise use a unique password and two-step verification.
4. Store passwords in an approved credential manager rather than reusing them.
5. Never approve a sign-in you did not initiate.
6. Give each person their own account.
7. Remove access promptly when somebody leaves or changes role.

6. Breaking the chain with layered controls

Individual vigilance matters, but it should never be the only thing standing between an attacker and your organisation.

People are busy, tired, distracted, helpful, and human. A security model which depends on every person recognising every deception, every time, will eventually fail.

What the NCSC says about spotting phishing

The National Cyber Security Centre (NCSC) warns that many organisations place too much weight on training staff to identify phishing emails, and that this approach alone can waste time and money without improving security.

“Phishing mitigations often place too much emphasis on users being able to spot phishing emails … Training your users – particularly in the form of phishing simulations – is the layer that is often over-emphasised in phishing defences.”

Source: NCSC, Phishing attacks: defending your organisation.

The NCSC recommends a layered approach instead: technical controls which reduce exposure, ways for staff to identify and report suspected phishing without fear, and a plan for what happens when an attack succeeds anyway.

Technical controls are a kindness to staff

It is tempting to think of firewalls, backups, restricted administrator rights, and password policies as purely technical matters. They are also something else: a form of kindness to the people who work and volunteer for your organisation.

A well-designed control means that one tired moment, one convincing message, or one honest mistake does not have to become a catastrophe for the organisation, or for the person who made it.

Every layer you add is one less thing a person has to get right alone.

What UK charities reported

In the UK Government’s Cyber Security Breaches Survey 2025/2026, charities reported the following basic technical controls:

• 65% had restricted administrator rights.
• 63% had updated malware protection.
• 57% had secure cloud backups.
• 56% had a password policy.
• 45% had a network firewall.

Source: Cyber Security Breaches Survey 2025/2026, Department for Science, Innovation and Technology, published 30 April 2026.

The readiness gap

Technology addresses one part of the picture. Being ready to respond when something still goes wrong is another.

In the same survey:

• 31% of charities had assigned incident roles or responsibilities.
• 30% had guidance on when to report externally.
• 28% had written guidance on who to notify.
• 19% had a formal incident-response plan.
• 54% reported none of these measures.

More than half of charities had none of the listed formal response measures. That is not a reason for shame. It is a clear place to improve, and it does not require expensive technology.

Source: Cyber Security Breaches Survey 2025/2026, Department for Science, Innovation and Technology, published 30 April 2026.

Nine layers which can break an attack

No single item on this list is sufficient by itself. Together, they are designed so that the failure of one layer does not automatically mean the failure of all of them.

1. Restricted administrator rights

   Most staff and volunteers do not need the ability to install software, change security settings, or access every system.

   Why: It limits how much a compromised ordinary account or device can control.

2. Passkeys or two-step verification

   Signing in should require more than a password alone, especially for email, finance, and administrator accounts.

   Why: It stops a stolen, guessed, or reused password alone being enough to sign in.

3. A password manager and unique passwords

   Every account should have its own password, generated and stored rather than remembered.

   Why: It stops one password exposed elsewhere from unlocking many accounts through credential stuffing.

4. Updated malware protection

   Devices should run current malware protection, kept up to date automatically where possible.

   Why: It helps identify and block known malicious software before it spreads.

5. A configured network firewall

   Unnecessary connections and exposed services give an attacker more to try.

   Why: It restricts unwanted network connections and reduces what is exposed to the internet.

6. Secure, tested cloud backups

   Backups should be stored separately from everyday systems and tested so that restoring them actually works.

   Why: It supports recovery and removes disruption as a lever an attacker can pull.

7. Dual authorisation for payments and bank-detail changes

   A second, independent person should approve new payments and any change to bank details, separately from whoever requested it.

   Why: It prevents one person, however senior or trusted, from being able to complete a high-impact financial action alone. The Charity Commission recommends dual authorisation as a fundamental control for charities banking online.

   Source: Internal financial controls for charities (CC8), Charity Commission for England and Wales.

8. A known, blame-free reporting route

   Every person should know who to contact immediately if something feels wrong, without fear of punishment for reporting an honest mistake.

   Why: It makes it more likely that a mistake is reported within minutes rather than hidden for days.

9. A brief, written incident-response plan

   The plan does not need to be long. It needs to say who to contact, what to do first, and how to avoid making the situation worse.

   Why: It removes the need to invent a response while already under pressure.

7. When something feels wrong — PAUSE

You do not need to be certain that you are looking at an attack before you act carefully.

A feeling that something is slightly wrong is enough of a reason to slow down. Genuine, urgent requests can almost always survive a short, careful pause. Fraudulent ones often cannot.

PAUSE is a short response you can recall under pressure, whether the moment arrives before you act or after you have already clicked, replied, or paid.

A Shellhex explanatory aid. PAUSE is Shellhex’s own plain-language response model. It is not a formal industry framework.

The PAUSE response

• Pause

  Stop before completing the requested action.

  This applies before clicking a link, opening an attachment, approving a sign-in, replying with information, or making a payment. A short pause costs almost nothing. Acting on a fraudulent request can cost a great deal.

• Avoid further action

  Do not click, reply, approve, pay, install, or disclose anything else.

  Avoid the temptation to investigate further using the same message, the same link, or the same phone number the request arrived through. Anything provided by the message itself cannot be trusted to verify itself.

• Use a trusted route

  Verify independently through contact details or services you already trust.

  Telephone a number you already had on file, not one taken from the message. Type a website address you already know, rather than following a link. Speak to a colleague directly if that is possible.

• Speak up

  Report quickly, including when you have already acted.

  Tell your organisation’s designated contact even if you are unsure, even if it turns out to be nothing, and even if you have already clicked, replied, or paid. A fast report gives your organisation the most options.

• Escalate quickly

  Protect accounts, money, information, devices, and other people.

  This may mean changing a password, contacting a bank, disconnecting a device from the network, or warning colleagues who may receive the same approach. Escalation is a shared responsibility, not something to be handled alone in silence.

What to do after a suspicious action

PAUSE applies before and after a click. If you have already acted, the following steps still apply, and reporting quickly still matters.

If you clicked a link or opened an attachment

If you entered a password, code, or personal information

If you approved a sign-in, made a payment, or changed bank details

If you are simply unsure

Reporting outside the organisation

The following routes apply in the United Kingdom. If your organisation operates in a different country, follow the equivalent guidance for your own jurisdiction and your organisation’s own escalation process.

Suspicious emails

Forward the original message rather than retyping or summarising it, so that its headers and links are preserved for investigation. Use your mail application’s forward function and send it, unedited, to the address below. Do not treat this as a normal contact address to write a new message to.

report@phishing.gov.uk

This is the National Cyber Security Centre’s Suspicious Email Reporting Service. You can forward as many suspicious emails as you like, even if you are not certain they are a scam.

Source: Report internet scams and phishing, GOV.UK.

Suspicious text messages

Forward the message to 7726, which is free on UK mobile networks. This reports the message to your mobile provider, who can investigate and block the sender.

Source: Report internet scams and phishing, GOV.UK.

If money has been lost, or you believe an account has been compromised

Report it to Report Fraud, the UK’s national reporting service for fraud and cyber crime, run by the City of London Police (also known by its earlier name, Action Fraud).

• Report online: reportfraud.police.uk.
• Report by telephone: 0300 123 2040 (Monday to Friday, 8am to 8pm).
• If your organisation is experiencing a live cyber attack right now, call 0300 123 2040 immediately; this line is answered 24 hours a day for that purpose.
• In Scotland, report to Police Scotland by calling 101.

Source: Guide to reporting cyber crime and fraud, Report Fraud.

Charity Commission

Trustees have a duty to consider whether a cyber incident, fraud, or significant financial loss must be reported to the Charity Commission as a serious incident, in addition to reporting it to the police and any other relevant regulator.

Source: How to report a serious incident in your charity, GOV.UK.

Further cyber-crime guidance

For help preparing for, and recovering from, a wider cyber incident, see the NCSC’s response and recovery guidance for small organisations.

Source: Small Business Guide: Response & Recovery, National Cyber Security Centre.

8. Five actions to take away

You do not need to redesign your organisation today.

Begin with five actions.

1. Save the reporting route

Know who to contact when:

• A message seems suspicious.
• A password may have been disclosed.
• A login was approved unexpectedly.
• Money may be at risk.
• A device behaves strangely.

Do not wait until an incident to discover the route.

2. Protect email

Use a passkey where available.

Otherwise use:

• A unique password.
• An approved password manager.
• Two-step verification.

Review recovery details and active sessions.

3. Verify high-impact requests independently

Use a known telephone number, official application, saved bookmark, or separate conversation.

Do not let one message both request and verify a high-impact action.

4. Publish deliberately

Review whether public information reveals:

• Absences.
• Internal responsibilities.
• Systems.
• Suppliers.
• Email patterns.
• Payment processes.
• Time-sensitive projects.

Keep what serves a real purpose.

Remove what no longer does.

5. Report quickly and without shame

Report:

• Suspicion.
• Near misses.
• Mistakes.
• Unexpected approvals.
• Attempts which were stopped.

The earlier the report, the easier the response.

The ten-minute charity defence drill

Provide this as a downloadable and printable checklist.

9. Closing

Final perspective

Cyber security is often presented as a contest between advanced technology and advanced attackers.

Much of the real contest is quieter.

It takes place in:

• A familiar email.
• A rushed payment.
• A public staff biography.
• A reused password.
• An unexpected approval.
• A report made quickly.
• A report never made.

An attacker succeeds by connecting opportunities.

A resilient organisation responds by breaking connections.

You do not need to recognise every attacker immediately.

You need safe processes, protected accounts, deliberate publication, and the confidence to pause when something does not feel right.

Source register and further guidance

Statistics and official guidance were checked on 27 July 2026.

Official statistics

• Cyber Security Breaches Survey 2025/2026 - Department for Science, Innovation and Technology, published 30 April 2026

  This is the source for all UK charity prevalence, control, frequency, disruption, and incident-response figures used in the course.

National Cyber Security Centre guidance

• Phishing attacks: defending your organisation
• Spotting cyber attacks - Small Organisations Guide
• Secure your email - Small Organisations Guide
• Passkeys: what you need to know
• Three random words
• Report a scam email
• Report a scam text message

Charity Commission guidance

• Protect your charity from cyber crime
• How to report a serious incident in your charity
• Protect your charity from fraud

Fraud reporting

• Report Fraud - England, Wales, and Northern Ireland
• Police Scotland: 101