CASE STUDY | Non-profit
Security awareness training that actually works
A mid-sized nonprofit with a fully remote team was dealing with phishing emails, account compromises, and constant uncertainty around suspicious messages. They needed a practical awareness program that would reduce human risk, not just satisfy a compliance checkbox.
Challenges
A mid-sized nonprofit with a fully remote team was seeing a steady increase in phishing emails, suspicious login attempts, and “Is this real?” tickets. Staff were mission-focused but not security experts, and most had never received formal cybersecurity training.
Over twelve months, the organization experienced multiple mailbox compromises, password reset fire drills, and growing concern about donor data exposure. Leadership knew human risk was one of their biggest vulnerabilities, but their only training was an annual checkbox exercise with no meaningful way to measure improvement or report progress to the board.
Solution
- Annual training course: A 45-minute online course covering phishing, passwords, safe remote work, and core cybersecurity practices.
- AutoPhish simulations: Ongoing phishing tests based on realistic attack scenarios, with targeted follow-up coaching.
- Dark web monitoring: Continuous monitoring for exposed employee credentials, with guided remediation when leaks were found.
- Weekly micro-training: Short videos and quizzes that kept security top-of-mind without disrupting productivity.
- EVA Score: Employee Vulnerability Assessment reporting that gave leadership a measurable view of human risk.
Results
- 72% reduction in phishing click rates compared to the baseline period.
- Zero mailbox compromises after rollout despite continued phishing attempts.
- 3 dark web credential exposures identified and remediated early.
- Near-100% completion rate for annual and ongoing training modules.
- Board-level visibility into human risk through clear reporting and EVA scores.
Conclusion
By replacing one-off training with a continuous, measurable awareness program, this nonprofit turned a major security weakness into a stronger first line of defense. Staff became better at spotting suspicious activity, compromised accounts dropped away, and leadership gained credible reporting they could share with the board.
If your organization is dealing with phishing, user confusion, or recurring account issues, RiskAware can help with security awareness training, phishing simulations, dark web monitoring, and the reporting needed to show real progress.
