Protection for Organizations and Nonprofits | ObscureIQ
For organizations and nonprofits

Your people are already inside the perimeter.

Organizations spend on firewalls, endpoint tools and email filters to keep attackers out. The attacks that do the most damage rarely break in. They are let in, by an employee who was given a convincing reason: a call from IT, a video call with the CFO, a message from the director.

What makes the reason convincing is information about the person. Most of it sits outside every system the organization controls, and much of it is for sale.

60%

of breaches in the 2025 Verizon DBIR involved the human element: a person deceived, misused or making an error.1

$2.8bn

lost to business email compromise in 2024, across 21,442 complaints to the FBI. The approach is a message that sounds like someone you trust.2

US$25.6m

paid out by one employee at Arup after a single video call with a deepfaked CFO and colleagues.3

01 · The pattern

The breach starts with a person.
The person starts with data.

In each of these, the attacker went around the organization's defenses by way of someone inside them, and had to know things about that someone first.

MGM Resorts

2023
Help desk impersonation

By the attackers' own account and press reports, they found an employee on LinkedIn, called the IT help desk as that person, and had the password and multi-factor authentication reset. Federal advisories on the group describe the same method. MGM's filings name no entry point.4

What they needed to know

A name, a role, and enough about the person to pass as them on the phone.

About ten days of manual operations. MGM reported a hit of about $100 million to quarterly earnings.

The 2023 breach record →

Arup

2024
Deepfake video call

A finance employee in Hong Kong doubted an email asking for a confidential transfer, then joined a video call with what looked and sounded like the CFO and other colleagues. Every one of them was a deepfake.3

What they needed to know

Faces, voices, and who reports to whom.

15 transfers, HK$200 million (about US$25.6 million).

Retool

2023
Cloned voice of IT staff

Employees received texts about a payroll problem. A follow-up call in the cloned voice of a real IT staff member talked one of them out of a one-time code.5

What they needed to know

Who works in IT, what they sound like, and a pretext about pay.

Accounts belonging to 27 cloud customers taken over.

LastPass

2022
The engineer's home computer

Attackers went after one of four DevOps engineers through an unpatched media server on his home computer, installed a keylogger, and used his credentials to reach the company's cloud storage.6

What they needed to know

Which few people held the keys, and how to reach them at home.

Customer vault data and customer information stolen.

WPP

2024
Cloned CEO on a Teams call

Scammers made a WhatsApp account with the CEO's public photo, set up a Teams meeting with a senior leader, and used a cloned voice and video of the CEO to ask for money and personal details.7

What they needed to know

A public photo, public audio, and the name of a leader to approach.

Stopped by the executive on the call. Most organizations will not be that lucky every time.

Coinbase

2025
Insiders recruited

Criminals bribed offshore customer support staff for customer data, then demanded a $20 million ransom. Coinbase refused.8

What they needed to know

Who works where, with what access, and who might say yes.

Estimated costs of $180 million to $400 million.

One Treasure Island

Nonprofit
Executive director impersonated

Attackers got into email through the organization's outside bookkeeper, slipped into real threads from look-alike addresses, wrote as the executive director, and changed the wire details on a real invoice.9

What they needed to know

Who approves payments, who the vendors are, and how the director writes.

$650,000 meant for an affordable housing project, gone.

The technology differs from case to case. The first step does not: learn enough about a person to be believed by them, or to be mistaken for them.

02 · Why the defenses miss it

Security protects the systems.
The attacker uses the people.

Every control below matters. None of them reaches what an attacker actually assembles before the first message is sent.

What the organization securesWhat the attacker uses
The network, the firewall and the endpointsAn org chart rebuilt from LinkedIn, staff pages and press releases
Email filtering and domain protectionA personal phone number and a personal email, bought from a people-search site
Identity and access managementThe help desk, and a caller who knows enough to sound like an employee
Payment controlsA leader's voice and face, cloned from a conference talk or a podcast
Security awareness trainingHome addresses, family members, and what is happening in someone's life this month

The data is collected outside.

Data brokers, people-search sites, breach dumps and advertising data hold what a pretext needs, about people the organization employs, without the organization or the person taking part. The Human Data Perimeter sets out the full argument.

Training asks people to carry it.

Awareness training covers what an employee can see. Most of what is known about them is below the waterline, beyond the reach of any control that depends on the employee.

AI made the approach cheap.

A public photo and a few minutes of public audio are enough to stand in for a leader on a call. A profile bought for a few dollars is enough to write a message that reads like it came from a colleague.

03 · What makes training stick

Teach people how they are targeted.
Security follows.

Security awareness training teaches rules about the company's data: do not share passwords, report the strange email. People pass the quiz and click anyway, because the company's exposure feels abstract. Privacy education starts from the person: how their own data is collected, sold and used to approach them. Once the threat is personal, the same approach at work is easier to recognize.

The research

Tawfiq Alashoor, IESE Business School

Alashoor studies how people make privacy and cybersecurity decisions. His work argues that security education, training and awareness (SETA) covers the basics, while privacy education, training and awareness (PETA) reaches the everyday disclosure decisions and psychological vulnerabilities that social engineering exploits.11

Mood beats concern

In experiments he describes, people in a happy, relaxed state disclosed more personal information than people in a neutral state, even when they said they were concerned about privacy.11

A pause works

Giving people an explicit way to decline, “I prefer not to provide this information,” reduced how much personal information they shared.11

Leaders lag

On a privacy culture index built from surveys of more than 1,000 employees, and repeated a year later with more than 1,400, company leaders scored lower than operational staff both years.1112

“Stop thinking of privacy in a separate compartment.”Tawfiq Alashoor, IESE Insight, January 2026

That is how we teach. Tactical Privacy Training shows each person how their own address, routine and credentials can be bought and used against them. The organization gets safer as a consequence, starting with the leaders.

04 · Nonprofits and smaller organizations

The same exposure,
with less to absorb it.

Large enterprises have security teams, executive protection and incident budgets. Smaller organizations and nonprofits face the same approaches, often with more of their people in public view, and nothing between the attacker and the staff.

01

Leadership is public by design

Staff pages, press, grant announcements and the Form 990, which names officers, directors, key employees and the highest-paid staff, with what they are paid, and must be open to public inspection. An attacker does not need to research an org chart. It is published.10

02

The cause draws the hostility

Advocacy, reproductive health, immigration, civil rights, election work, research on contested questions. The anger is aimed at the organization and lands on named people, often at home.

03

Money moves on trust

Grants, vendor payments and payroll run through small finance teams and outside bookkeepers, by email. That is the exact shape of a business email compromise.

04

There is no one to call

Below a certain size there is no security team, no executive protection, often no full-time IT. The executive director is also the incident responder, and the board finds out last.

05 · Why ObscureIQ

Built for the perimeter
that runs through people.

Reducing human exposure takes a different set of tools from securing a network: knowing where personal data lives, getting it removed and keeping it down, and analysts who can tell an early signal from noise. That is the whole of what we do.

01

We start from the people, not the network.

An audit of what is exposed about each person in scope, household included: what an adversary can find, buy, connect and use. Your IT provider protects the systems. We map the perimeter that runs through people's lives.

Exposure discovery and reduction →
02

We know where the data sits.

CODEX, our map of the commercial surveillance economy, tracks more than 8,600 companies that build profiles of people. That is why removal reaches the brokers, people-search sites and archives that matter, and why it stays down.

CODEX →
03

Analysts read what software flags.

Monitoring for doxxing, impersonation, leaked credentials and hostility that starts to move toward a person or a place, read by analysts who decide what it means. When it becomes a threat, we find out who is behind it.

ThreatWatch →
04

We are the security function you do not have.

We connect what security, legal, communications and leadership see separately, so the organization acts from one picture. Where there is no in-house security function, which is the norm below a certain size, we are that function.

Digital executive protection →
05

Coverage follows risk, and scales to a staff.

Leaders, finance, and the people with the most access get the closest attention. Coverage is structured so extending protection across a whole staff is practical, not a luxury reserved for the top of the org chart.

The Human Data Perimeter →
06

We measure it.

Every engagement sets a baseline on the Threat Surface Index, person by person and for the cohort. The work moves the number, and the refresh states the difference. You can show a board what changed.

Threat Surface Index →
06 · When organizations call us

Usually after one of these.
Better before.

Trigger 01

Leadership is named in a public filing.

The 990, a state registration, a court record. The org chart is already out.

Trigger 02

The cause is drawing coordinated hostility.

Campaigns, pile-ons and threats that name staff, not just the organization.

Trigger 03

There is no in-house security function to call.

The executive director is also the incident responder.

Trigger 04

Someone has impersonated a leader.

A text, an email or a voice that was not theirs, asking for money or access.

Trigger 05

A public moment is coming.

A campaign launch, testimony, a layoff, a contested decision. Attention is about to arrive.

Trigger 06

A staff member has been doxxed or followed.

Once a home address is in circulation, the risk is no longer online.

Questions organizations ask

In short answers.

Do you work with nonprofits and smaller organizations?

Yes. Much of our organizational work is with nonprofits, advocacy groups and organizations without a dedicated security team. The exposure is often higher there, because leadership is public by design and there is less in place to absorb an incident.

We have no security team. Can we still do this?

Yes, and that is the most common case. We work with your leadership and whoever handles IT, and we provide the discovery, reduction, monitoring and analyst judgment a security function would.

Who in the organization is covered?

That is decided by risk, not by title alone. Typically leadership and the board first, then finance and the people with the most access, then the wider staff. Households are included where the risk reaches home.

Does this replace our IT security?

No. IT security protects your systems. We reduce the personal exposure that lets an attacker walk past them by way of a person. The two work together.

What does it cost to cover a whole staff?

Coverage is tiered, and it is built so protecting a staff does not cost what protecting a chief executive costs. We walk through the options on the first call, which is free and confidential.

Sources
  1. Verizon, 2025 Data Breach Investigations Report, as reported by ClearanceJobs, 30 Apr 2025. Source
  2. FBI Internet Crime Complaint Center, 2024 report, as summarized by Nacha, 24 Apr 2025. Source
  3. CNN, British engineering giant Arup revealed as $25 million deepfake scam victim, 16 May 2024. Source
  4. Adaptive Security, MGM ransomware attack: the $100 million help desk phone call, 11 Sep 2026, which separates MGM's filings from the attackers' claims; Insurance Journal, 31 Jan 2024. Source
  5. The Hacker News, Retool falls victim to SMS-based phishing attack, Sep 2023. Source
  6. The Hacker News, on the LastPass engineer's home computer, 7 Mar 2023. Source
  7. The Guardian, as recorded by the AI Incident Database, 10 May 2024. Source
  8. The Block, Coinbase estimates $180M to $400M in costs tied to customer data breach, May 2025. Source
  9. CyberTalk, $650,000 stolen from nonprofit, 7 Jun 2021. Source
  10. IRS, Public disclosure and availability of exempt organization returns; Instructions for Form 990, Part VII. Source
  11. Tawfiq Alashoor, Why your biggest cybersecurity risk isn't technology, it's your people, IESE Insight, 1 Jan 2026. Source
  12. Alashoor, Boodraj, Quintanilha, Palme and Aldawood, Insights on how data privacy officers can build a corporate privacy culture, MIS Quarterly Executive 24(1), 2025. Source

Measure the human perimeter before someone else does.

An organizational baseline shows what is exposed about the people in scope, tier by tier, and what it would take to reduce it. The first call is free and confidential.

Request a confidential call →The Human Data Perimeter →
Not just your systems.
Your people.