Charity penetration testing is a controlled attempt to break into your charity’s systems, run by a skilled tester who uses the same methods a criminal would. Its job is to show you which weaknesses can really be exploited, so trustees can fix the serious ones before a donor database, a bank login or a safeguarding record is exposed. Most small and mid-sized charities do not need a huge programme. They need the right test, on the right systems, at a sensible time.
Table of Contents
Why would a charity be a target for hackers?
Criminals do not pick victims on moral grounds. They look for money, personal data and weak defences, and charities often hold all three. You take online donations, you keep supporter and beneficiary records, and you pay suppliers by bank transfer.
The government’s Cyber Security Breaches Survey 2025 shows the scale. Of 1,081 UK charities surveyed, 30% reported a breach or attack in the previous 12 months. Phishing was the most common type, affecting 86% of the charities that had an incident.
The same survey found that only 9% of charities had run a penetration test in the past year, and only 30% had a trustee or board member with explicit responsibility for cyber security. That gap is where attackers operate.
What does charity penetration testing actually involve?
A penetration test follows a set pattern. The National Cyber Security Centre (NCSC) describes five stages: initial engagement, scoping, testing, reporting and follow-up. So here is what charity penetration testing looks like in practice.
- Scoping: you agree what is in and out of bounds, such as your website, donation platform, Microsoft 365 tenant or office network.
- Testing: the tester looks for ways in, then tries to use what they find, within the rules you set.
- Reporting: you get a list of issues, each rated by risk, with advice on how to fix it.
- Follow-up: your team fixes the problems, and the tester checks the fixes work.
The NCSC makes one point that is easy to miss. A test only shows what was exposed on the days it ran. It should check your own vulnerability management, not replace it.
Which systems should a charity test first?
Start with whatever would hurt most if it failed. Because budgets are tight, most charity penetration testing begins with a short list.
- Your donation and fundraising pages. These handle payments and personal details, and they are public. A web application penetration test covers them well.
- Email and cloud accounts. Most charities run on Microsoft 365 or Google Workspace. One stolen login can expose years of correspondence.
- Your supporter or case-management database. This is usually where the most sensitive personal data sits.
- Office network and Wi-Fi. Shared offices, charity shops and community venues often have loose network setups.
- Remote access. Volunteers and home workers connect from many places, so VPNs and remote desktop deserve a look.
If a third party hosts any of these, check your contract. You usually need the provider’s written permission before anyone tests their platform.
Is a penetration test the same as a vulnerability scan?
No. A vulnerability scan is an automated check that lists known weaknesses. It is quick and cheap, so it is useful to run regularly. A penetration test is mostly manual. A person tries to chain weaknesses together, the way an attacker would, and shows what they could actually reach.
The PCI Security Standards Council puts the difference clearly in its guidance. A scan identifies and ranks vulnerabilities, while a penetration test looks for ways to exploit them to defeat security features. Charities that take card payments directly should also read the PCI material, because it sets its own testing rules.
| Question | Vulnerability scan | Penetration test |
|---|---|---|
| How is it done? | Mostly automated tools | Mainly manual, by a skilled tester |
| What do you get? | A list of known weaknesses | Proof of what can be exploited, and how far an attacker could get |
| How often? | Regularly, such as monthly or quarterly | Yearly, and after major changes |
Does a charity need a penetration test to get Cyber Essentials?
Not for the basic scheme, because Cyber Essentials checks that you have core controls in place, such as firewalls, patching and access control. It does not require a penetration test. Many charities start there. It is a sensible first step. Our guide to Cyber Essentials and penetration testing explains how the two fit together.
Also, funders and partners are asking harder questions. A local authority or a large grant-maker may want evidence that your systems have been independently tested. A recent report from charity penetration testing gives you a clear answer.
What are the legal duties if something goes wrong?
Trustees carry real responsibility here, so it helps to know the rules before an incident, not during one.
- The ICO: if a personal data breach is likely to put people’s rights and freedoms at risk, you must tell the Information Commissioner’s Office within 72 hours of becoming aware of it.
- The Charity Commission: trustees must report significant cyber crime, fraud and data breaches as serious incidents, “as soon as is reasonably possible” after becoming aware.
- Report Fraud: cyber crime and fraud should also go to Report Fraud, and you should get a crime reference number.
Charities with an income over £25,000 also declare in their annual return that no reportable incidents went unreported. Charity penetration testing does not remove these duties, but it does lower the odds you will need to use them.
How do you get the most from a charity penetration test?
Good preparation saves money, and it gives better results. These steps help.
- Pick a named owner, ideally a trustee or senior manager, so findings do not stall.
- Tell the tester about unusual systems early. The NCSC advises this so the provider can confirm it has the right skills.
- Check the testers’ qualifications and experience. Quality depends heavily on the people doing the work.
- Keep a technical contact free during the test, in case a serious finding needs a fast decision.
- Agree the fixes and a retest date before the report arrives.
Then use the findings to learn. For example, if the tester got in through a weak password policy, fix the policy as well as the single account.
Frequently asked questions
How often should a charity run a penetration test?
Once a year is a common baseline for charity penetration testing, plus a test after a major change such as a new donation platform or a move to the cloud. If your risk is lower, a longer gap can be reasonable, but write down why.
Will testing disrupt our services?
Testers work to avoid disruption, but the NCSC notes that unexpected effects cannot be ruled out. Agree test windows, and avoid peak fundraising periods.
Can volunteers or in-house staff run the test?
Yes, they can learn from scans and checklists. For assurance that trustees, funders and insurers will trust, use an independent, qualified tester who did not build or run the systems.
What if we only have a small budget?
Then narrow the scope. Test the donation site and email first, fix what comes back, then widen the scope next year. A small, well-chosen test beats a broad one you cannot afford to act on.
Should we do anything before testing?
Yes. Turn on multi-factor authentication, patch what you can and remove accounts that are no longer used. That way the test finds harder problems, not easy ones you could have fixed for free.
Where can a charity get expert help?
If you would like charity penetration testing scoped to your charity’s size and risk, Aardwolf Security offers penetration testing for UK organisations. You can get in touch to talk through what would be worth testing first. If you only want to start with free guidance, the NCSC’s small organisation resources are a good place to begin.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
