Charities are “far behind companies” in their preparedness for dealing with a potential cyber-attack, a survey of governance professionals has found.

The Chartered Governance Institute of UK & Ireland’s Boardroom Bellwether 2026 survey found that just over two in five charity and not for profit governance professionals say their organisation's preparation is “limited or non-existent”.

In comparison only one in 22 governance experts within private and listed companies said their organisation's preparation for a potential attack was poor.

Among those that are prepared only one in four charity governance professionals described this as “very thorough”, compared to around two in three of their company counterparts.

The Institute notes that “charity governance teams are rarely large and often have limited in-house IT support”.

AI risks

Expertise in managing artificial intelligence (AI) risks is also lacking within charities, compared to companies. More than three in four charity governance professionals say their board lacks expertise in this area, compared to two in five of those working for firms.

One in three charity professionals say their board “has no meaningful capacity at all” in dealing with AI risks.

One charity governance leader surveyed said trustees are “not keeping up with the developments, risks and their responsibilities around AI”. Charities are also less likely to treat AI as a governance focus, less than half of charity respondents said it was one of their organisation’s top three priorities, compared to more than four in five of those working for businesses.

“Charity respondents were more than twice as likely as those in companies to name financial resilience, reflecting the financial strain on the sector,” said the Institute.

Its survey also found that charity respondents are more than twice as likely as listed company respondents to cite a lack of board expertise or experience as a “material challenge to good governance”.

“Charity boards are largely made up of volunteer trustees, supported by governance teams that are often very small,” said the Instutute’s chief executive Linda Ford.

“These findings show many of them facing cyber and AI risks without the preparation or expertise those risks demand, while financial pressures compete for their time and resources.”

She added: “The report points to two distinct challenges. Many charity boards are still building the knowledge and confidence needed to oversee AI effectively, while cyber security is often an implementation challenge.

“As cyber threats continue to grow in scale and sophistication, policymakers, funders and regulators should consider whether charities have sufficient practical support to turn guidance into effective protections.”

The latest Charity Fraud Survey, published in January this year by BDO in collaboration with the Fraud Advisory Panel and involving the views of 164 charities during 2025, found that while fewer incidents of fraud had been reported more than half of charities said their fear of a cyber attack had increased.

---