IT support for nonprofits Austin leaders can count on starts with an uncomfortable question in 2026: does your yearly security training actually stop anyone from clicking a bad link? Two large studies of phishing training reached very different answers, and the gap between them shows Central Texas executive directors exactly where to spend limited time and money. October is Cybersecurity Awareness Month, which makes this a good week to find out.
Quick Answer: A once a year, check the box training session barely changes behavior, but short, frequent, practical training paired with easy reporting and strong sign in protection does. Plan on monthly five minute lessons, realistic practice emails, and multifactor authentication as the safety net.
Key Takeaways
- An independent eight month trial at a large health system found that employees trained within the last 30 days failed phishing tests about as often as those overdue by a year or more.
- Vendor reported data says phishing susceptibility can fall from 33.2 percent to 4.2 percent after a year of ongoing training, so frequency and program design matter more than the annual event.
- Nonprofits carry extra risk because volunteers, board members, and seasonal staff rotate in and out and often use personal email.
- Making it easy to report a suspicious message, with no blame, is worth more than any lecture.
- Training reduces clicks but never eliminates them, so sign in protection and email filtering must catch what training misses.
What's at Stake
A nonprofit runs on trust. Donors trust you with payment details and giving history. Clients trust you with case notes, health information, and family situations. Grantors trust you to manage restricted funds with care. One staff member who clicks a convincing fake invoice or a fake "update your payroll" message can put all three kinds of trust at risk in a single afternoon.
Most executive directors already know this, which is why most organizations run some form of annual security training. The problem is that the annual session is often treated as proof the risk is handled. The evidence says it usually is not.
In a randomized controlled trial presented at Black Hat USA by researchers Christian Dameff of UC San Diego and Ariana Mirian of Censys, more than 19,500 employees at UC San Diego Health were split into groups and tested with simulated phishing emails over eight months. Employees who had completed their annual training within the previous 30 days did no better than those who were more than a year overdue. Embedded, just in time training lowered failure rates by only about 1.7 percent on average. By month eight, 56 percent of employees had failed at least one simulation.
That is a sobering result for any organization that has one training video and a signed acknowledgment form on file.
Why Central Texas Businesses Face This Challenge
The pressure is real for nonprofits and small businesses across Austin, Round Rock, Georgetown, and Taylor. Growth across the corridor means more donors, more clients, and more email. Teams are lean, so one person often handles finance, HR, and the website. Year end giving season, which starts to build in the weeks ahead, floods inboxes with legitimate payment and receipt messages, and that is exactly the cover attackers like to hide behind.
Nonprofits also deal with a turnover pattern most businesses do not. Volunteers join for a single event. Board members check email from a personal account on a phone. Interns arrive in May and leave in August. A training model built for a stable, full time workforce does not fit that reality, and the villain here is the same one we see everywhere: IT that is reactive, hard to reach, and absent until something has already gone wrong. You deserve technology and support that helps your mission thrive, not just survive.
How CTTS Helps
We have served Central Texas since 2002, and more than 100 businesses and nonprofits have trusted us with their IT. Our clients rate us at 96 percent CSAT across 159 surveys, and a local team answers the phone in three rings. Our job is to be the guide while you stay the hero of your own mission.
For organizations with 10 to 250 employees, we build security habits into the monthly rhythm instead of making them a once a year event. That means short lessons your staff can finish between meetings, realistic practice messages that mirror what is hitting Central Texas inboxes right now, a simple way to report anything suspicious, and technical protection behind all of it. For clients on Complete Care Coverage, this work is part of how we manage your environment every month rather than a separate project you have to remember to buy.
What Security Training Actually Changes Behavior?
Does Annual Phishing Training Work?
Not by itself. The San Diego trial found no meaningful link between how recently someone finished annual training and how likely they were to fail a test. The takeaway is simple: a yearly session builds awareness for a few days, but habits form through repetition.
What Do the Two Big Studies Really Say?
They look contradictory but point the same direction. In July 2026, KnowBe4 reported that across 14.8 million users in 64,000 organizations, the share of employees likely to engage with a phishing attack fell from 33.2 percent at baseline to 20.1 percent after 90 days and 4.2 percent after a year of ongoing training. That is vendor reported data, and the release does not describe how organizations were selected, so treat the exact numbers with care.
The San Diego trial is independent and randomized, but it measured a program where engagement was low: between 37 and 51 percent of embedded training sessions lasted zero seconds. Among people who did complete interactive training, later failures dropped by 19 percent. Our reading is that training works when people actually engage with it, repeatedly, and does very little when it is skipped, rushed, or delivered once.
How Often Should Staff and Volunteers Train?
Monthly, in very small doses. Five minutes a month beats sixty minutes a year because it keeps the habit fresh and it fits a nonprofit calendar. Volunteers and board members should get a short onboarding lesson on day one, before they ever receive an organization email address or shared folder access.
Why Make Reporting Easier Than Clicking?
Because the fastest defense is a coworker who says "this looks strange" within minutes. A one click report button in Microsoft 365, paired with a thank you instead of a lecture, turns every employee into a sensor. Organizations that shame people for clicking teach them to hide mistakes, and hidden mistakes are the ones that become breaches.
What Backstops Protect You When Someone Clicks?
Training will never be perfect, so plan for the click. Multifactor authentication on every account, conditional access rules that block risky sign ins, email filtering that catches lookalike domains, and tested backups of your donor database all limit the damage. Think of training as the lock on the front door and these controls as the alarm, the safe, and the insurance policy.
Take the Next Step
If your current plan is a yearly video and a signed form, you do not have a security training program yet, and the fix is easier than most directors expect. Our Executive IT Risk Assessment reviews how your team handles email, sign ins, and reporting today, and shows you where a few small changes would cut the most risk. Schedule a free strategy session with CTTS and we will walk through it together.
Have Questions? We've Got Answers
Should volunteers get the same security training as employees?
Yes, but in a shorter form. Anyone who touches donor data, shared drives, or organization email should complete a short lesson before getting access. Keep it to the five or six habits that matter most, and refresh it each time a new volunteer class begins.
How do we know whether our training is working?
Track three numbers over time: the share of practice phishing emails that get clicked, the share that get reported, and how long it takes staff to report a real suspicious message. Falling clicks and rising reports mean habits are changing. Completion percentages alone only show that people opened a lesson.
Do practice phishing emails embarrass our team?
Not when they are handled well. Share results as organization wide trends rather than naming individuals, thank people who report, and use clicks as a chance to teach. The goal is a team that feels safe raising a hand, which is the strongest early warning system a small nonprofit can have.
Contact CTTS today for IT support and managed services in Austin, TX. Let us handle your IT so you can focus on growing your business. Visit CTTSonline.com or call us at (512) 388-5559 to get started!