Cyber Security and Penetration Testing for UK Charities

Cyber security and penetration testing for UK charities

UK charities occupy a difficult position in the cyber security landscape. They hold sensitive data — on donors, beneficiaries, volunteers, and staff — that carries GDPR obligations equivalent to those of commercial organisations. But they typically operate with far smaller IT budgets and less technical expertise than the businesses facing the same threats.

The Charity Commission has highlighted cyber security as a significant risk area for the sector. The NCSC's Cyber Security for Charities guidance notes that charities are attractive targets because they hold financial data, personal information, and sometimes particularly sensitive information about vulnerable beneficiaries.

Why charities are targeted

Financial fraud is the primary motivation. Charities receive donations by bank transfer and process gift aid claims — both attractive targets for attackers who can intercept or redirect payments. Business email compromise targeting charity finance staff is a documented and growing threat.

Sensitive beneficiary data is the secondary target. Charities working with vulnerable people — those experiencing domestic abuse, mental health difficulties, addiction, or homelessness — hold particularly sensitive information that could cause serious harm if disclosed.

Ransomware attacks on charities have increased significantly. The disruption to services affects the people charities exist to help, creating additional pressure to pay.

The regulatory context

Charities are subject to UK GDPR and the Data Protection Act 2018 in exactly the same way as commercial organisations. The ICO does not apply a lower standard to charities. Serious breaches can result in fines that would be devastating for organisations with limited reserves.

The Charity Commission's guidance on digital and cyber security references the need for appropriate technical measures. Larger charities are increasingly required by major funders to demonstrate cyber security compliance.

Common vulnerabilities in charity websites and systems

Donation pages and online payment processing systems that are not properly secured create risk for donor financial data. If payment processing is handled in-house rather than through a certified third party, the risk is significantly higher.

Volunteer and beneficiary data held in case management systems accessed through web interfaces may have authentication weaknesses. Shared passwords and accounts are common in organisations with high volunteer turnover.

Email systems without SPF, DKIM, and DMARC records allow attackers to send emails appearing to come from the charity — targeting donors with fraudulent donation requests.

Outdated website software is common in charities where the original developer is no longer involved and no ongoing maintenance budget exists.

Cost-effective security for charities

Traditional penetration testing costs £3,000–£15,000 — unaffordable for most charities. Yrzo AI provides automated security testing at £399, covering the web application attack surface and delivering a plain-English report in under 20 minutes. Evidence of security testing that satisfies funder requirements and demonstrates GDPR compliance to the ICO.

The NCSC also offers free Cyber Essentials support for charities through its funded programme — worth investigating alongside automated testing.