After phishing attacks: How an association made its team secure regardless of location

What it is about: a non-profit association under phishing pressure

A non-profit organization with a large membership operating across borders had experienced several phishing attacks – and drew the right conclusion: Instead of waiting for the next incident, it raised awareness of information security among its entire team of paid staff and volunteers, regardless of location. The result is qualitative but noticeable: Phishing attempts are now recognized more reliably, and suspicious messages no longer end up in the trash without comment but are reported – all without travel costs, without scheduling, and without a dedicated IT security team.

Behind the organization is a structure typical of the non-profit sector: Many committed people work alongside their main job or as volunteers, spread across several countries and with limited IT resources. At the same time, the association processes sensitive personal data – of members, supporters, and donors. It is precisely this combination of valuable data and scarce resources that makes associations attractive to attackers and at the same time makes effective security difficult to implement.

Why the starting situation was particularly tricky

In a distributed team shaped by volunteers, a single careless click is enough to hit the entire organization. It is therefore not enough to train only the core paid staff – what was needed was a uniform, solid level of knowledge for everyone involved, regardless of location, role, and available time. Classic classroom training was practically impossible in this setup: Bringing volunteers to one place at a fixed time fails because of everyday life, distance, and the voluntary nature of their commitment.

Then there is the legal side. Because personal data is processed, raising employee awareness is one of the organizational measures that Article 32 GDPR requires for an appropriate level of protection. Security awareness is therefore not an optional extra but part of the duty of care – also for non-profit organizations and associations.

The authorities confirm that the danger is real: According to the report on the state of IT security in Germany 2025 by the Federal Office for Information Security (BSI), phishing remains a threat that is consistently rated as high – and people are the most common gateway. If you know typical attack patterns, you can defuse them; knowing how to recognize phishing is therefore the core of every effective awareness measure.

The solution: security awareness as flexible e-learning

A note on our own behalf: Bridgly provided ready-made information security training that specifically teaches how to recognize, correctly handle, and prevent phishing and cyberattacks. Instead of a one-off campaign, this resulted in a repeatable process: Via the Bridgly learning environment, everyone completes the training exactly when it fits their own schedule – in their main job, alongside other work, or as a volunteer, and regardless of location. A task that could hardly be solved organizationally thus became a straightforward digital process.

The core content is deliberately practical. Security awareness here does not mean abstract IT knowledge but learned confidence in acting in everyday life: How do I recognize a fake message? What do I do if I suspect something – and whom do I contact? The training is thus aimed precisely at the people who, in an emergency, decide whether an attack comes to nothing.

A look at the business world shows that such duties of care are not an exception: Many companies are now subject to stricter requirements, for example from regulations such as NIS-2. For a non-profit organization without its own IT security team, standardized awareness training that is always available is therefore a pragmatic path to a professional level of security – without having to develop or maintain its own courses.

Targeted phishing training

The focus was on recognizing typical attack patterns – fake senders, dangerous attachments and links, and artificially created time pressure that tempts people into careless clicks. Participants practiced classifying suspicious signals instead of just memorizing rules.

Establishing a reporting culture

Reacting is just as important as recognizing. The training conveyed that a reported suspicion is always better than a silent click – and thus removed the reluctance to speak up about a possible mistake. In this way, individual attentive people become an organization that makes incidents visible early and can respond to them more quickly.

Independent of location and time for paid staff and volunteers

Because the training is digital and self-paced, it also reached volunteers who would hardly have attended a fixed in-person session – and thus precisely the group that is otherwise hardest to train. No one had to travel, and no one had to sacrifice a free evening.

A uniform standard with traceable proof

Everyone involved reached the same solid level of knowledge across national borders – regardless of location and role. At the same time, the learning environment makes it traceable who has completed the training. This proof helps the organization to also be able to demonstrate its awareness measures within the meaning of the GDPR.

The result: stronger awareness, little organizational effort

The entire organization has reached a uniform, solid level of knowledge regardless of location. Employees now recognize phishing attempts and cyberattacks more reliably and react more calmly – without travel costs, without scheduling, and without major organizational effort. The reaction to specific attacks has turned into lasting security awareness that can easily be continued with new employees and volunteers.

This case study deliberately does not cite any success rates or percentages: The gain lies in a strengthened security culture and in confidence in acting that shows in everyday life – not in a single key figure.

What other organizations can take away

• Don't wait for the first damage. Security awareness is significantly cheaper and less burdensome than the consequences of a successful attack.
• Digital reaches everyone. In practice, distributed and volunteer teams can be reached comprehensively much more easily regardless of location and time than via fixed in-person sessions.
• Responding is part of it. An open reporting culture turns attentiveness into real protection.
• A uniform standard protects. A shared level of knowledge closes the weakest links in the chain – which is where attackers strike.

We collect further practical reports – from city administrations to start-ups – in our case studies.

Do associations also have to train their employees in IT security?

As soon as personal data is processed, Art. 32 GDPR requires appropriate technical and organisational measures – and these include raising employee awareness. Non-profit organizations and associations are not exempt from this either.

How do you train volunteer and distributed teams?

Via e-learning that is independent of location and time. This way, people who work alongside their main job or as volunteers can also complete the training when it fits their schedule – without travel or scheduling effort.

What belongs in phishing training?

Recognizing typical attack patterns (fake senders, dangerous attachments, artificial time pressure), correct handling in the event of suspicion, and basic rules on passwords and sharing data.

How often should security awareness be refreshed?

In practice, a refresher at least once a year is considered customary, supplemented by event-driven updates after new waves of attacks or incidents. The organization's risk-based needs are decisive.

• Regulation (EU) 2016/679 (GDPR), Art. 32 – Security of processing, EUR-Lex – accessed 8 Jun 2026.
• BSI – How do I recognize phishing in emails and on websites? (Federal Office for Information Security) – accessed 8 Jun 2026.
• BSI – The State of IT Security in Germany 2025 (reporting period 1 Jul 2024–30 Jun 2025, published 11 Nov 2025) – accessed 8 Jun 2026.
• Featured image: AI-generated using an internal image prompt template; subsequently labeled with the visible notice "Created with AI" (Art. 50 EU AI Act). License: own commercial use by Bridgly.