Cybersecurity for Nonprofits in California: Shadow AI
Cybersecurity for Nonprofits in California: What Leaders Need to Know About Shadow AI
What is the biggest cybersecurity risk for California nonprofits right now? Staff using AI tools that leadership never approved, paired with phishing that steals sign-in sessions in real time. Both risks sit in leadership’s job description, not IT’s. At Advantage Microsystems, we have supported California mission-driven organizations for 27 years, and the pattern holds. The tools change faster than the policies. This guide explains what shadow AI is, what current data says, and five questions an Executive Director can ask this week.
What shadow AI is, and why nonprofits feel it first
Shadow AI is any AI tool staff use for work without the organization’s approval or oversight. A development associate drafts a donor letter in a free chatbot. A case manager summarizes notes with a browser extension. A program director pastes a spreadsheet into an AI tool before a grant deadline.
Nobody is being careless. They are short-staffed, the deadline is real, and the policy in the binder predates the tool. Lean nonprofit and behavioral health teams reach for anything that saves an hour.
What the data says about AI, phishing, and breach cost
- IBM Cost of a Data Breach Report 2025: 20% of studied organizations suffered a breach tied to shadow AI. For organizations with high levels of shadow AI, those breaches added $670,000 to the average cost.
- IBM Cost of a Data Breach Report 2025: healthcare breaches averaged $7.42 million, the highest of any industry.
- Microsoft Digital Defense Report 2026: browser extensions posing as AI assistants reached nearly 900,000 installs and touched 20,000-plus enterprise tenants. They collected AI chat histories.
- Microsoft Digital Defense Report 2026: adversary-in-the-middle phishing now makes up 44.6% of identified phishing techniques. It steals MFA codes and session cookies in real time.
IBM’s figures come from independent Ponemon Institute research and reflect organizations that experienced breaches. Treat them as a warning about scale, not a prediction for your organization.
Why this lands on leadership, not IT
Policies written before AI are already out of date. Meanwhile, attackers, auditors, accreditors, and county contract reviewers are all watching for the gap.
A breach does not stay quiet anymore. It becomes a headline, and the name attached is the Executive Director’s. That is why Cybersecurity Awareness Month now has two fronts: traditional security, and the AI your staff already use.
Five questions to ask your team this week
- Which AI tools do our staff use today, approved or not?
- What client, donor, or patient information has gone into them?
- Who approved each tool, and who can turn it off?
- When did we last update our data policy, and does it mention AI?
- If something leaked tomorrow, who would we call, and who would speak to the board?
Where to start
Take stock before writing rules. Then write rules your staff can read in two minutes. Start with the “Would You Know?” Breach Assessment.
Questions About IT Support for Nonprofits – Answered by Advantage Microsystems
Q: Does my organization need an AI policy if we don’t use AI?
A: Shadow AI is the use of AI tools for work without organizational approval or oversight. It matters because staff can enter donor, client, or patient data into tools leadership cannot see. IBM’s Cost of a Data Breach Report 2025 found that 20% of studied organizations had a breach tied to shadow AI.
Q: Does multi-factor authentication stop phishing attacks?
A: MFA remains essential, but it does not stop every attack. Microsoft’s Digital Defense Report 2026 says adversary-in-the-middle phishing, which steals session cookies in real time, now makes up 44.6% of identified phishing techniques. Monitoring for unusual sessions closes more of that gap.
Q: How much does a data breach cost a behavioral health organization?
A: IBM’s Cost of a Data Breach Report 2025 puts the average healthcare breach at $7.42 million, the highest of any industry. Your own cost depends on size and records exposed. The figure shows what is at stake when you hold client health records.
Q: What should a nonprofit Executive Director ask their IT provider about AI?
A: Ask which AI tools staff use, what data enters them, and who approved each one. Ask when the data policy was last updated and whether it mentions AI. At Advantage Microsystems, we walk California nonprofit leaders through those questions in plain language.
