# Cybersecurity Playbook for Nonprofits for AI pt 2

An episode of [Community IT Innovators Nonprofit Technology Topics](https://invisiblenetwork.ai/podcast/1536843269), 30 Oct 2026, 35 min.

Audio: https://www.buzzsprout.com/1029925/episodes/20004645-cybersecurity-playbook-for-nonprofits-for-ai-pt-2.mp3

In Part 2 of the Nonprofit Cybersecurity Playbook, Updated for AI webinar, Carolyn Woodard and Matthew Eshleman, CTO of Community IT, walk through the checklist at the heart of the new Start Here: Nonprofit Cybersecurity Basics download. Part 1 made the case that AI changes the risks but not the basics. Part 2 gets specific about what those basics are, starting with one that is not technical at all: someone at your organization has to own cybersecurity, because you cannot outsource your risk. Matt also answers listener questions on choosing a password manager and keeping your emails out of spam folders, then looks at new twists on old attacks. Phishing now arrives through calendar invites and shared documents, wire fraud is starting with a phone call again, and fake copyright notices pressure organizations to pay up rather than call their lawyer. Across all of them, the best defense is a culture where staff feel comfortable reporting anything that seems off. Haven’t listened to Part 1 yet? Find it in your podcast feed. This episode covers: • Why phish-resistant MFA like passkeys is the next step, as vendors like Salesforce move to require them and Microsoft drops text and voice codes in February 2027. • How a password manager for every staff member, third-party spam filtering, and regular security awareness training reduce your biggest source of risk. Matt sees third-party filtering cut phishing volume by up to 80%. • Why AI-driven discovery of software vulnerabilities means more frequent patches, and why backups should extend beyond Microsoft and Google to your website, CRM, fundraising, and finance systems. • The policies to put in writing, including personal device use, official systems of record, and an AI acceptable use policy, even if your policy is that you don’t use AI. • Why your cybersecurity owner needs milestones, time, and support to do the work, not just one more thing on their plate. Resources Mentioned: • Nonprofit Cybersecurity Playbook, Updated for AI Webinar, Community IT • Start Here: Nonprofit Cybersecurity Basics, Community IT • Cybersecurity Readiness for Nonprofits Playbook, Community IT • Template, Acceptable Use of AI Tools in the Nonprofit Workplace, Community IT • Creating an IT Roadmap, Community IT • Podcast on DMARC and DKIM, Community IT • Webinar: Should Your Nonprofit Use AI? Community IT • Data Breach Investigations Report, Verizon _______________________________ Start a conversation :) • Register to attend a webinar in real time, and find all past transcripts at https://communityit.com/webinars/ • email Carolyn at cwoodard@communityit.com • on LinkedIn • on reddit/r/nonprofitITmanagement • on the Community IT website Thanks for listening.

## Transcript

[0:23] Community IT Intro: Thank you for joining this Community IT podcast part two.
[0:27] Community IT Intro: You can find part one in your podcast feed if you subscribe wherever you listen to podcasts.
[0:33] Carolyn Woodard: Welcome everyone to the Community IT webinar, celebrating the re-release of our Playbook on cybersecurity readiness for nonprofits, updated for the age of AI with the author, Matt Eshleman.
[0:47] Carolyn Woodard: My name is Carolyn Woodard.
[0:48] Carolyn Woodard: I am the outreach director for Community IT, and I'll be the moderator today.
[0:53] Carolyn Woodard: All right, so just giving you that link again to the Foundational Cybersecurity Basics new download that we have.
[0:59] Carolyn Woodard: We're really proud of this booklet.
[1:01] Carolyn Woodard: And then Matt, we're gonna move into this checklist that is included in this booklet.
[1:08] Carolyn Woodard: It goes through these different areas and then you get this checklist at the end.
[1:11] Carolyn Woodard: So can you talk a little bit about that?
[1:14] Matthew Eshleman: Yes.
[1:14] Matthew Eshleman: So thanks for putting this up here.
[1:17] Matthew Eshleman: And I think it is a good, you know, I really appreciate the fact that you were thinking about how to present this information and yeah, pulling out that checklist for organizations that are just getting started.
[1:27] Matthew Eshleman: And I do think you know, cybersecurity is one of those areas where you really do need to cover your bases and having that good foundation to build on is very important.
[1:36] Matthew Eshleman: And so getting the basics right is absolutely critical.
[1:42] Matthew Eshleman: So you'll notice that that first recommendation here on the list of own it, it's not technical at all.
[1:49] Matthew Eshleman: It's just talking about accountability.
[1:51] Matthew Eshleman: you know, I'd say Community IT, we believe that organizations cannot outsource their risk, which means that someone at your organization needs to take responsibility for cybersecurity, right?
[2:02] Matthew Eshleman: You cannot, you know, send that out to your kind of MSP or whatever, right?
[2:08] Matthew Eshleman: A large part of their response and controls, you know, you can outsource, right?
[2:11] Matthew Eshleman: You need somebody to, you know, with capacity to manage and monitor and report and analyze and do all those things.
[2:17] Matthew Eshleman: But at the end of the day, you know, someone at your organization needs to have that role clearly assigned to them, to somebody on staff, to make you know kind of those fundamental decisions.
[2:29] Matthew Eshleman: And it's a great idea to leverage external partners for the kind of the monitoring and the operation, right?
[2:34] Matthew Eshleman: It's a it's a really focused skill set that's that's required for kind of keeping, you know, kind of monitoring everything and deploying things and all of that configuration.
[2:46] Matthew Eshleman: but you can't outsource kind of the ownership of risk for for the organizations.
[2:51] Matthew Eshleman: you're hearing this right, kind of going through the checklist.
[2:56] Matthew Eshleman: All right, so we've got somebody in our organization, it's really clear that they own cyber cybersecurity.
[3:02] Matthew Eshleman: Then the next thing we want to make sure is that we want to make sure that MFA is enabled for everybody.
[3:09] Matthew Eshleman: You know, maybe that is moot, you know, we've been talking about this.
[3:12] Matthew Eshleman: I think you know, we've been doing our Cybersecurity Playbook for years and years and years, and MFA, I think, has been in there every single year as a recommendation.
[3:20] Matthew Eshleman: You know, we've now evolved that recommendation really to move out into passkeys to help provide some more phish resistant capability, right, to combat against the most common types of cyber attacks.
[3:32] Matthew Eshleman: We're seeing vendors make moves in this area.
[3:33] Matthew Eshleman: I think Salesforce is, you know, kind of make it made a big move, right?
[3:36] Matthew Eshleman: Moving from, hey, like you need to have you know one-time passcodes, now they're requiring and enforcing passkeys for everybody.
[3:43] Matthew Eshleman: And so the vendors themselves are taking more responsibility for kind of enabling that cybersecurity by default.
[3:51] Matthew Eshleman: Microsoft themselves will be dropping support for voice and SMS multi-factor authentication in February of 2027.
[3:59] Matthew Eshleman: So again, if you are an Office 365 customer and you're still getting text messages or a call, know that Microsoft is gonna stop allowing that as a method.
[4:08] Matthew Eshleman: I mean, they're literally like the service is not gonna work anymore.
[4:11] Matthew Eshleman: And so you'll need to move to a more secure method of multi-factor authentication.
[4:15] Matthew Eshleman: And what I would say is I would just take this as an opportunity to move into what we call passkeys or phish resistant MFA as a way to really protect your digital accounts from those outside threat actors.
[4:29] Matthew Eshleman: Once you get MFA in place, you know, taking a look at using the password manager is a great great option.
[4:38] Matthew Eshleman: So while you know we talk about maybe more sophisticated solutions like single sign-on for for larger organizations or organizations that maybe have more resources, that can be complicated and have some licensing implications.
[4:51] Matthew Eshleman: But for organizations just starting out, getting a password manager for all staff is a great start.
[4:57] Matthew Eshleman: I'll say unfortunately, we still find lots of password spreadsheets in place at organizations.
[5:03] Matthew Eshleman: So do yourself a favor, evaluate some password managers out there that have that team functionality, get a license, assign it to everybody in your organization so that you can manage passwords and make sure that you have unique, complex passwords for each site that you access, protect it with MFA, and you really raise the, you know, raise the bar for your security protection because of that.
[5:29] Matthew Eshleman: Moving into security awareness training or phishing awareness training here.
[5:34] Matthew Eshleman: we know that you know, from the data that we see, the Verizon security report, the their DBIR report implicated staff manipulation in a majority of breaches.
[5:48] Matthew Eshleman: I think it was like over 60%, were of breaches that were reporting to them, kind of came through kind of user error, user manipulation, that kind of thing.
[5:57] Matthew Eshleman: and what we find is that regular security awareness training helps to build that culture of security, which is key to minimizing your risk.
[6:06] Matthew Eshleman: You want to give staff the tools so that they can kind of correctly identify whenever something doesn't quite seem right, to have some technical tools to identify links, to evaluate different scenarios so that they feel confident in responding to those situations when they get into them.
[6:23] Matthew Eshleman: You know, we also want to make sure that as part of that training, staff kind of feel confident or comfortable reporting it.
[6:30] Matthew Eshleman: They know where to go, they know how to kind of report that information and that they don't feel bad and kind of just try to ignore it or hide it.
[6:38] Matthew Eshleman: So, you know, we want to build that culture of security and openness where people share things that are happening to them.
[6:44] Matthew Eshleman: And I'm really encouraged when I'm you know talking to different organizations.
[6:47] Matthew Eshleman: I know a lot of folks, you know, they'll mention their Teams, you know, their Teams chat or their Slack to be like, hey, like I got a really weird message and it looked like this, right?
[6:56] Matthew Eshleman: Just to give the heads up that they saw something strange and they want to share that it what it looked like so that other people are aware and can avoid it.
[7:06] Matthew Eshleman: And then the final piece, you know, just in tops in terms of talking about avoiding it, is you know, getting really good third-party spam filtering in place.
[7:14] Matthew Eshleman: So you know, for us, you know, because we work with all nonprofits and we know that price is important, right?
[7:20] Matthew Eshleman: We don't mandate that, but have it available as an add-on.
[7:24] Matthew Eshleman: And so through some of those metrics, right, we can kind of get some data between the organizations that have third-party spam filtering and those that don't.
[7:32] Matthew Eshleman: We can see that the third-party security tools are dropping or reducing the phishing volume, right?
[7:38] Matthew Eshleman: So those messages that are trying to get you to click on something, to open up an attachment, to maybe copy and paste something into your command prompt, right?
[7:46] Matthew Eshleman: dropping the volume of those phishing emails by up to 80%.
[7:50] Matthew Eshleman: So technology isn't perfect, but it can really help to reduce the biggest source of risk to an organization, which is malicious emails, right?
[7:59] Matthew Eshleman: At the end of the day, you know, that is a very common attack vector, and they do it because it works.
[8:05] Matthew Eshleman: So if you can get that third-party spam filtering service and reduce the amount of junk that your staff are getting, that that's a huge help.
[8:13] Matthew Eshleman: You know, we know that Microsoft and Google have some built-in tools, but we find you know it's this is one of those things where it is really worth paying extra for.
[8:24] Carolyn Woodard: I there's a couple of questions before you move on to the closing the gaps.
[8:29] Carolyn Woodard: One is if you have any recommendations for good password management tools, specifically for legal organizations, but I'm wondering if you just are are there any that are better than the others, or there's I know that there's several that work really well.
[8:44] Matthew Eshleman: Yeah, so I would say the ones that we see kind of most most often would be Keeper.
[8:48] Matthew Eshleman: Looks like that that was a recommendation.
[8:51] Matthew Eshleman: Dashlane, I think they have some nonprofit discounting, and so I think that can be a compelling often uh offering and 1password.
[8:59] Matthew Eshleman: You know, I think the you know, in terms of like which one is best, it's probably you know, the answer again is like not really like is one technically superior to another.
[9:09] Matthew Eshleman: It's like which one is your organization going to use and adopt?
[9:11] Matthew Eshleman: And so I you know would really encourage organizations, yeah, take advantage of some of those free trials, set three different systems up side by side, explore, use them, kind of figure out which one works best for your organization, and and go with that one, right?
[9:27] Matthew Eshleman: So the you know, if you have a password manager but nobody uses it, right?
[9:32] Matthew Eshleman: That doesn't really do you much good.
[9:33] Matthew Eshleman: And so having a tool that you feel comfortable with, that makes sense to you, that you can you know easily use and administer, like that's the one you want to go with.
[9:42] Matthew Eshleman: And you know, there are lots of good options out there.
[9:45] Carolyn Woodard: Have the person that keeps their passwords in the spreadsheet be on that team that's evaluating which password keeper you're gonna use, because they are the ones that are gonna need to use it.
[9:55] Carolyn Woodard: All right, second question is a client.
[9:58] Carolyn Woodard: This person says, I had an issue where a client, my emails to them kept getting dropped into their spam junk folders, even though they attempted to flag me as okay as a sender.
[10:10] Carolyn Woodard: So is there anything you can do like on your end about false positives on spam filtering?
[10:17] Matthew Eshleman: We could probably have a whole webinar just on that.
[10:21] Matthew Eshleman: But I will say there's a couple of really kind of key acronyms to think about.
[10:26] Matthew Eshleman: I know we're trying to stay away from a lot of that, but making sure that you your email is kind of compliant or up to date with what's called SPF, which is kind of sender policy framework, which is hey, here's where emails are supposed to come from for our domain.
[10:39] Matthew Eshleman: Make sure that's correct.
[10:41] Matthew Eshleman: And that is combined with DMARC, so which basically says, hey, if you get an email and it says it's from this domain but it's not on this list, reject it, right?
[10:50] Matthew Eshleman: That's more of like protecting your domain from spoofing.
[10:53] Matthew Eshleman: And then DKIM kind of goes along, you know, with with the other two that kind of signs your message that says yes, like this message does did indeed come from the domain that it that it says it it did.
[11:06] Matthew Eshleman: So making sure that those things are in place and you can use some web tools called you know MXToolbox or something to to do some searching.
[11:13] Matthew Eshleman: it can be a little bit mystifying sometimes, right?
[11:17] Matthew Eshleman: Sometimes whatever, you know, your domain or maybe a link in your signature will get flagged on some spam engine, and it just takes a while to kind of figure that out.
[11:27] Matthew Eshleman: So yeah, it's but making sure those those three records are in place and accurate you know usually solves most of the problems with yeah, with with kind of having your mail redirected to junk.
[11:43] Carolyn Woodard: And we did a podcast a little while ago on that, so I shared that link here and it'll be in the transcript as well that just talks a lot more about what DMARC and DKIM are.
[11:53] Matthew Eshleman: Perfect.
[11:54] Carolyn Woodard: All right, so closing the gaps, the rest of the checklist.
[11:58] Matthew Eshleman: Yeah, so you know, you know, continuing our recommendations and basic controls, you know, you may have noticed a much more frequent cadence for patching and updates this year.
[12:07] Matthew Eshleman: And I would say that is a hundred percent tied to the explosion in the use of AI to find and exploit software vulnerabilities.
[12:14] Matthew Eshleman: All the vendors are scrambling to react, right?
[12:17] Matthew Eshleman: They're they're scanning their own code for vulnerabilities, stuff is getting reported, right?
[12:21] Matthew Eshleman: It's just a kind of a I don't know, free-for-all jailbreak, right?
[12:25] Matthew Eshleman: There's just lots of stuff being discovered, and so vendors are pushing updates really frequently to just kind of deal with and keep up with the flood of that.
[12:35] Matthew Eshleman: So you know, we say reboot your computer monthly, maybe you need to reboot it weekly, right?
[12:42] Matthew Eshleman: Just but it it sounds kind of silly, but checking to make sure your software is up to date and rebooting your computer regularly is a really good security practice.
[12:50] Matthew Eshleman: So make sure you're doing that on the regular and don't ignore the updates because if there's a patch released, it's usually because there was some exploit that was identified.
[13:01] Matthew Eshleman: The other note here, antivirus, anti- malware, managed and maintained.
[13:04] Matthew Eshleman: Again, you know, we have really seen a big spike in the amount of malicious activity.
[13:09] Matthew Eshleman: It's kind of being detected on endpoints.
[13:11] Matthew Eshleman: And so making sure that you have good tools in place, that they're active and they're in use and they're configured and they're updated, right?
[13:18] Matthew Eshleman: can help provide that extra layer of protection.
[13:21] Matthew Eshleman: You know, so just you know, make sure that you've got something in place and it's up to date.
[13:27] Matthew Eshleman: And then the final piece is is around you know, kind of resiliency and be able to recover if and when you know you do have some sort of data breach or data loss.
[13:39] Matthew Eshleman: and so making sure that you have a good third-party backup tool in place is key to recovery, you know, so whenever that data maybe has been lost or corrupted.
[13:48] Matthew Eshleman: So I will say, you know, Google and Microsoft, right, they both provide some basic capabilities in terms of you know, kind of trash can or you could recover some data, but that you know is limited, right, from a time perspective, right?
[14:04] Matthew Eshleman: They maybe only have 30 days worth of retention in those situations.
[14:07] Matthew Eshleman: It could also be times where you know the way data is deleted, it doesn't show up in those places.
[14:12] Matthew Eshleman: So having a third-party backup in another system that you can control and manage is key to being able to recover data in the event that it's lost or stolen.
[14:24] Matthew Eshleman: and I would also probably expand this definition, right?
[14:27] Matthew Eshleman: you know, we often think of Google and Microsoft as kind of the big ones because we're primarily focused on kind of IT and operations, but that should also extend to your website, your CRM system, your fundraising system, your finance, accounting, right?
[14:42] Matthew Eshleman: Kind of all of these applications.
[14:45] Matthew Eshleman: You know, we often think, hey, it's in the cloud, it's all taken care of.
[14:48] Matthew Eshleman: That maybe means, right, you don't have to maintain the hardware underneath of it, but it is good to clarify with your vendors, hey, what happens if you know a malicious actor gets in and corrupts a bunch of our data or deletes a bunch of stuff?
[15:01] Matthew Eshleman: Like, how could we get that back?
[15:02] Matthew Eshleman: You know, and just have you don't need to know the technical details of how all of it works, but having those kind of clear scenarios to say, how would we respond in this case or how would we respond in this other scenario can be good to just kind of confirm that things are going to work as you expect when you kind of run into that scenario.
[15:20] Carolyn Woodard: All right.
[15:20] Carolyn Woodard: And then we have a few more things on the checklist and then we'll be able to get to some recent threats.
[15:26] Matthew Eshleman: Yes.
[15:27] Matthew Eshleman: great, you know, we've talked about it a lot.
[15:29] Matthew Eshleman: You know, policies are important.
[15:31] Matthew Eshleman: And, you know, I think a lot of these were on our update, you know, two years ago, and now, you know, the addition would say here, you know, kind of is the AI acceptable use policy.
[15:43] Matthew Eshleman: So I think policies are a great way to start because they help an organization distill and define kind of what they're gonna do and how it's gonna get done.
[15:51] Matthew Eshleman: And putting things down in writing means that you'll have some discussion around maybe some assumptions that people have and conflict areas that, you know, if you're not talking about it, you know, you you can kind of ignore.
[16:03] Matthew Eshleman: And so, you know, things that often come up in organizations, it's kind of this policy exercise is good to clarify, are things like the use of personal devices to access work data.
[16:15] Matthew Eshleman: unless you've done something proactive, right?
[16:19] Matthew Eshleman: you can't necessarily wipe data from personal devices if they are lost or stolen, right?
[16:24] Matthew Eshleman: Interns, contractors, you know, right?
[16:27] Matthew Eshleman: A lot of remote staff, you know, you don't have control of the devices themselves.
[16:31] Matthew Eshleman: And so if a device is lost or stolen, it's really important that you understand what controls and parameters you have in place to protect data that may be on those devices.
[16:43] Matthew Eshleman: Understanding where your data is as an organization, what are those official systems of record, who maintains them, who supports them, what data is there, how is it archived, deleted, you know, kind of all of those questions are good to clarify.
[16:57] Matthew Eshleman: Again, with all the proliferation of SaaS applications, it's super easy for somebody to just sign up for an app, put a bunch of data in it, start using it, right?
[17:05] Matthew Eshleman: and so you have a lot of ungoverned data out there.
[17:07] Matthew Eshleman: So being clear about this is our official systems of record, here's how we're using them, here's who has access, you know, those are good conversations to have to clarify how all the workflows are supposed to happen.
[17:19] Matthew Eshleman: And with AI, it's you know, again, that you know, you we've got great templates.
[17:25] Matthew Eshleman: It's something that you need to I think work and be really flexible on, but also be kind of very don't be overly prescriptive as this is changing super rapidly.
[17:35] Matthew Eshleman: So, you know, I think in our templates, right, we like to start with what's approved and then iterate regularly.
[17:40] Matthew Eshleman: Like here's the things we're working on now.
[17:42] Matthew Eshleman: Let's kind of you know, give a use this, not that framework, and you know, make sure that it's updated regularly.
[17:50] Matthew Eshleman: So, you know, A AI is a tool.
[17:53] Matthew Eshleman: It's a tool that a lot of organizations are using.
[17:56] Matthew Eshleman: It's also a tool that you don't have to use, right?
[17:59] Matthew Eshleman: There there seems to be, you know, the feeling that, hey, everybody else is doing it, but you know, you can also take a stand to say, hey, we're not gonna use it, and and make that clear to staff as well.
[18:11] Matthew Eshleman: Like I said, in the absence of really good communication and maybe technology controls to prevent it, staff are 100% using AI tools.
[18:20] Matthew Eshleman: You know, it's something that we can see.
[18:22] Matthew Eshleman: and it's good to provide that clarity to organizations that you know that these things are in use and and they're really widespread.
[18:34] Matthew Eshleman: So you do need an AI policy, even if your policy is that you don't use AI at your organization.
[18:40] Matthew Eshleman: We've talked a little bit already about the cyber liability, cyber liability insurance conversation, right?
[18:46] Matthew Eshleman: If you don't have that protection in place already, it's a good one to start with your, I would start with your existing broker.
[18:54] Matthew Eshleman: you know, it can seem like a big new expense, but it's a pretty common policy.
[19:00] Matthew Eshleman: You probably want to bundle it with other things you already have, right?
[19:03] Matthew Eshleman: and so having that protection in place so that you know you have you know some guardrails in case your organization you know is a victim of of wire fraud or something really significant that that impacts your operations or you know protects your protects you in the event of maybe you have a data leak and right you need to provide reporting on all the people's data that you know that that was disclosed.
[19:33] Carolyn Woodard: So and then that compliance piece.
[19:38] Matthew Eshleman: Yep.
[19:39] Matthew Eshleman: So I think closing the compliance loop is you know making sure that you actually have a plan, right?
[19:44] Matthew Eshleman: So that person that or the team maybe that we identified at the start as the owner has built-in milestones that are built into their performance expectations and maybe more importantly, right, the time and support to actually do that work.
[20:00] Matthew Eshleman: You know, I think you know, in nonprofit organizations, it just seems like you know, there's always kind of more work to do and not enough time allocated for for it.
[20:08] Matthew Eshleman: but this is something that you know needs to have kind of formal recognition that this is a responsibility that this person has.
[20:16] Matthew Eshleman: And we're also gonna give them the time that they need to carry out that work.
[20:21] Carolyn Woodard: Yeah, I think that's how people or organizations get behind, is it's just something else put on somebody's plate and they didn't make any room on the table for that plate to be on there.
[20:30] Carolyn Woodard: So making sure that you're supporting that person.
[20:33] Carolyn Woodard: I'm just gonna show this example very quickly.
[20:36] Carolyn Woodard: It's an example of an IT roadmap that you might make for this person or the person might make for the organization of what you're gonna do, how urgent it is.
[20:45] Carolyn Woodard: You can you know put extra columns on here for who's gonna do it, how much it's gonna cost, when it's gonna be done by all of those pieces.
[20:54] Carolyn Woodard: And that is just like a great way to report back on your progress.
[20:58] Carolyn Woodard: So, like I said, cybersecurity can feel like you're always what running in place, like there's always more stuff to do.
[21:04] Carolyn Woodard: So, for a lot of organizations, having some kind of checklist where you're like, look at what you accomplished.
[21:09] Carolyn Woodard: You didn't have MFA a couple of months ago, and now everybody has it.
[21:13] Carolyn Woodard: So just being able to check those off is really important.
[21:16] Carolyn Woodard: and I have a link here that I can share with you about creating an IT roadmap, which could include security.
[21:25] Carolyn Woodard: You can do it just for security.
[21:27] Carolyn Woodard: I want to move a little bit quickly through some of these other levels that are in the Playbook.
[21:33] Carolyn Woodard: If you've downloaded the Playbook, you'll see these other levels, but again, do a risk assessment first.
[21:39] Carolyn Woodard: Cybersecurity is a journey, not a destination.
[21:43] Carolyn Woodard: Developing that roadmap, being intentional about improving your cybersecurity will help reduce your risk.
[21:50] Carolyn Woodard: So it is very worth putting the effort into.
[21:52] Carolyn Woodard: And I went through that quickly because I wanted to be able to get you to like weigh in on this, Matt.
[21:58] Carolyn Woodard: So some new twists on some old cybersecurity attacks.
[22:03] Matthew Eshleman: As we talked about, right, phishing and account compromise, right, and user targeted things are the main are, you know, continue to be the main point of attack for for scammers in in 2026.
[22:14] Matthew Eshleman: And you know, viruses are back, they're worse than ever.
[22:18] Matthew Eshleman: you know, there's lots of really sophisticated ways now that adversaries are able to yeah kind of pull on those levers right to get people to to you know click on the link to you know provide that MFA code you know to kind of do the work you know kind of do the work so to speak for them.
[22:39] Matthew Eshleman: And so you know we certainly see that a lot we've had you know a couple of recent account compromises in both cases they were organizations that didn't have third party spam filtering and you know they got some very convincing messages that they clicked on and then they got forwarded around and it's like it just ends up being a real mess to to try to clean up. S o again the sophisticated email attacks are are you know continue to be very effective for these threat actors.
[23:10] Matthew Eshleman: I think the new things that we are seeing is that right phishing doesn't always you know kind of come as that link.
[23:16] Matthew Eshleman: We're starting to see stuff like calendar invites come in, you know, they kind of land and they you know kind of kind of go around a lot of the spam filtering tools.
[23:25] Matthew Eshleman: You know things are often you know shared as a document and then they have the instructions in the document that kind of conveniently tell you you know how to you know copy and paste maybe a code that's going to allow somebody else to access your system.
[23:40] Matthew Eshleman: So you know being cautious of you know kind of how you're receiving those even if it's from somebody that you know because it is likely that you know their account could have been compromised and kind of then used to target and pivot to other you know to other email you know kind of contacts that are in that organization's domain.
[24:04] Matthew Eshleman: We're also seeing you know like I said wire fraud is you know continues to be kind of the big right at the end of the day the amount of financial you know fraud that goes on is is really the main driver and that continues to increase year over year.
[24:24] Matthew Eshleman: And you know that you know I think gets carried out through a number of different ways from phone calls to updating invoices to payment change requests and so you know all these different methods are kind of new spins on old techniques you know fundamentally designed to get access to banking information that they are not supposed to have.
[24:47] Matthew Eshleman: And then you know we have the last item here right as attacker in the middle attacks continue . And so you know that is where you get a link it looks realistic it even looks like your Office 365 or Google sign-in page but it's going through an attacker's an attacker's kind of framework and so they're actually able to steal your session right they're not taking your password so to speak but they effectively have what they need to appear as you.
[25:16] Matthew Eshleman: A nd so that's why we are making that push to switch to phish resistant passkeys or security keys as a way to kind of mitigate that risk.
[25:28] Matthew Eshleman: The next slide you know kind of continuing on some of these other attacks that we are seeing you know are you know kind of job posting HR scams that impersonate your organization. W e're starting to see you know kind of more around deepfakes usually starting to get something out of your organization like money or access but you know many nonprofit organizations are also concerned about deepfakes that would cause you know represent representational harm a reputational harm, by you know misrepresenting policies or staff members' views.
[26:02] Matthew Eshleman: S o you know there's lots of things to be concerned about in terms of protecting your organization's identity and trust that you've built up over time.
[26:13] Matthew Eshleman: And so you know these are just kind of new technology tools that are available and organizations are going to need to find ways and strategies to kind of verify and validate and be able to provide assurance that you know the content that you're putting out you know is in fact is in fact you.
[26:29] Matthew Eshleman: The other piece I did want to highlight here is that you know a lot of this is kind of technology and kind of delivered you know kind of over the over the internet, right?
[26:40] Matthew Eshleman: Email, you know, web attacks so on and so forth.
[26:43] Matthew Eshleman: But we've also seen what maybe seem like throwback attacks around wire fraud that's initiated over the phone first.
[26:52] Matthew Eshleman: Maybe that ties into some of these deep fake capabilities right to to to let people, create you know more polished you know conversational tone and so we have seen or have heard reports where you know the the bank so to speak right calls in to verify some information and and they're able to kind of convince or or kind of get that information from people on on staff.
[27:19] Matthew Eshleman: A nd so again there's some technology tools that you can have in place maybe to prevent some attacks there's some training tools or if there's some process tools and so uh viewing this as as a holistic perspective on how to protect your organization is going to involve more than just you know buying the spam filter right?
[27:37] Matthew Eshleman: it's gonna also involve talking about how do we make banking change information that's a conversation you need to have internally and it's a conversation to have with your financial institution as well.
[27:48] Carolyn Woodard: I want to make sure we talk about that last bullet point because I know we have legal people attending, so I had never heard of this DMCA copyright infringement notices that are fake.
[28:02] Carolyn Woodard: And so what what is that?
[28:05] Matthew Eshleman: Yeah so it's a it's kind of a technique you know that actually I think has been in use for a while where you know the Digital Millennium Copyright Act I think you know is a real is a real piece of legislation that's designed to protect those people with digital copyrights, to say hey like you know you can't just use my you know audio or images or whatever without attribution.
[28:27] Matthew Eshleman: B ut it can also be used and manipulated to create a realistic kind of legal sounding threat that again is just trying to get you to make a payment to a fraudster you know because of some vaguely worded you know kind of legal threat, right?
[28:44] Matthew Eshleman: I think as soon as everybody's like oh the lawyers are involved I'm getting this you know this legal you know sounding message I need to comply with it, and so again treat those with caution.
[28:57] Matthew Eshleman: It's not to say right you just want to delete everything because it's 100% a scam that's not true, right, there could be legitimate communication that you're getting because you know somebody accidentally you know or you know didn't didn't get the correct permissions to use a certain piece of media on a website or an appeal.
[29:15] Matthew Eshleman: So there could be legitimate cases where you receive these takedown notifications but it's also I'd say primarily used by scammers as a way to just kind of worm their way into your organization and you know put up a dollar amount right there it's like oh well it's just cheaper to pay this than to talk to our lawyer about you know whether we should or not.
[29:35] Carolyn Woodard: So it's just amazing what they will come up with.
[29:38] Carolyn Woodard: And I mean using that.
[29:40] Carolyn Woodard: I think one of the things that we teach in that awareness, cybersecurity awareness is look at your emotions.
[29:46] Carolyn Woodard: Are you, is it trying to appeal to fear or shame or you know some other you know like quit embarrassment, doing something quickly with urgency and just be aware of how you're reacting to something, and have that trigger you to think wait should I be worried about this or not?
[30:03] Carolyn Woodard: Are they just trying to get me?
[30:04] Carolyn Woodard: So unfortunately we're kind of running out of time for the QA.
[30:09] Carolyn Woodard: So what I'm gonna propose Matt is that we just go over to Reddit after this and so if you have more questions go ahead and join us on Reddit over there and Matt will be there to answer questions.
[30:20] Carolyn Woodard: I wanted to make sure to go back over our learning objectives we had for today which was that you know learn our basic approach to cybersecurity understand the new threats in the age of AI we've talked about many of them.
[30:34] Carolyn Woodard: A nd I think you know there's kind of a theme of if AI can make it convincing a scammer is gonna do that.
[30:41] Carolyn Woodard: So there are going to be new brand new things - like doing those patches right away keeping an eye out for stories that are coming out about you know new scams that are coming out is just really - it's changing so quickly so keep an eye on that.
[30:55] Carolyn Woodard: Learn the foundational level that we recommend that is in our basics download it's also in the Playbook.
[31:01] Carolyn Woodard: And then the takeaways is you know kind of those first steps and best practices in managing cybersecurity at your nonprofit we shared that checklist that you can use, it is in the basics download that you can use.
[31:12] Carolyn Woodard: And here are those two links again to the URLs.
[31:16] Carolyn Woodard: Before you go I want to make sure to invite you back next month for our final webinar of 2026 and this is a you know just a little topic a little you know side note should your nonprofit use AI?
[31:29] Carolyn Woodard: So this is a question we get asked a lot.
[31:31] Carolyn Woodard: It's out there in the nonprofit environment a lot.
[31:34] Carolyn Woodard: We're gonna do a kind of different format with this webinar to talk about it.
[31:38] Carolyn Woodard: I'm gonna be joined by Steve Longenecker who's our director of IT consulting and Nuradeen Aboki who's our senior consultant both of them have worked with a lot of clients on AI and AI implementation and readiness but they've also worked with clients that don't want to do AI.
[31:55] Carolyn Woodard: So we're gonna answer five or six common questions that nonprofits have about AI, starting with that existential one, moving on to readiness, security, impact.
[32:05] Carolyn Woodard: The three of us have very different experiences with AI tools and with the ways our clients use them.
[32:11] Carolyn Woodard: We don't always agree.
[32:12] Carolyn Woodard: So I'm really looking forward to this conversation it's gonna be at 3 p.m eastern noon Pacific on Wednesday November 18th please join us and we if you submit your questions at registration we might answer one of them on our panel.
[32:27] Carolyn Woodard: You can register now on our website at communityit.com and I'm putting that in the chat as well.
[32:33] Carolyn Woodard: So go ahead and register for that.
[32:35] Carolyn Woodard: Don't forget as you exit the webinar today to take our short survey one lucky winner chosen at random receives a $25 gift certificate for helping us learn how we're doing join us over on Reddit.
[32:47] Carolyn Woodard: Matt's going to answer some questions over there.
[32:49] Carolyn Woodard: Matt, I want to thank you so much for your time today and for all your work on helping update this Playbook and develop the basics download so that you know our community really has what they need to get started.
[33:02] Carolyn Woodard: Cybersecurity can be so lingo ridden and emotional you know, it's you want to put it in the in the drawer and just not worry about it.
[33:12] Carolyn Woodard: So really appreciate your time and helping inform us and help us educate ourselves.
[33:18] Carolyn Woodard: I want to appreciate everyone on the webinar today your gift of an hour with us is something we don't take lightly you're in the right place you're worried about cybersecurity and getting better at it getting better at it is something that we really believe all of us can do.
[33:34] Carolyn Woodard: It is not beyond you so go ahead and download these free guides and Matt thank you again so much for your time today.
[33:42] Matthew Eshleman: Yes thank you Carolyn and and I'll just yeah highlight you know my meeting information is up it was posted there again there's lots of stuff that you know you can read and try to understand but I'm also happy to yeah have a short conversation and just clarify some of those questions that yeah that that that come up it's really important for us to help build that foundational knowledge around protecting your organization's data from all the threats that are out there.
[34:07] Carolyn Woodard: Yeah we just want the nonprofit sector to be doing this as well as we can, so thank you again and we will see you over there on Reddit.
[34:16] Community IT Intro: Thanks everyone thank you for joining this Community IT podcast part two you can find part one in your podcast feed if you subscribe wherever you listen to podcasts

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.