Church Cybersecurity Risks: 6 Trends Leaders Need to Watch

Church cybersecurity risks extend far beyond suspicious emails. AI, human error, vulnerable software, data privacy, vendors, and insurance are changing the threat landscape.

And, while cybersecurity can sound like an IT problem, it is increasingly a financial, legal, operational, and governance issue for churches.

Key takeaways:

What are the biggest cybersecurity risks churches should watch? Church leaders should pay particular attention to AI-enhanced fraud, phishing and social engineering, software vulnerabilities, sensitive data, third-party vendors, and the financial consequences of cyber incidents.

Bottom line: Artificial intelligence can make cyberattacks faster and more convincing. Churches should no longer assume obvious spelling errors or strange wording will expose a fraudulent message.

For years, spotting phishing emails sometimes meant looking for obvious mistakes, but that method is becoming less reliable.

Generative AI can help attackers produce polished emails, text messages, and other communications. Moreover, attackers can imitate familiar communication styles and create convincing requests.

Church IT consultant Jonathan Smith, a Church Law & Tax editorial advisor, warns that AI has made low-tech attacks appear increasingly credible.

In Why 2FA Matters More than Ever in the Age of AI, Smith recommends using two-factor authentication (2FA) or multifactor authentication (MFA) wherever possible.

The federal government’s guidance is similar. 

The Cybersecurity and Infrastructure Security Agency’s (CISA) Secure Our World initiative recommends four foundational practices: recognize phishing, use strong passwords, turn on MFA, and update software. For churches, MFA is particularly important for accounts involving:

However, MFA isn’t foolproof. Staff members must understand that an unexpected authentication request can itself be a warning.

Go deeper: Why 2FA Matters More than Ever in the Age of AI

Bottom line: Cybersecurity isn’t only about firewalls and software. A church employee who clicks the wrong link or approves the wrong transaction can bypass strong technical safeguards.

A pastor emails the finance office asking for an urgent payment.

A vendor suddenly changes its banking information.

A staff member receives a text requesting gift cards.

These situations may look routine and it’s why they can be so risky.

Church Law & Tax has examined scams involving churches where attackers used normal human behavior, rather than sophisticated computer hacking.

As Hacking a Church Is About Exploiting Its Weakest Link explains, generative AI can make these attempts even harder to identify. 

Therefore, churches need controls around high-risk actions.

For example:

The Federal Trade Commission (FTC) also recommends regular employee training and phishing simulations. In addition, organizations should give employees a simple way to report suspicious messages. 

Technology matters. However, so does the person sitting at the keyboard.

Go deeper: Hacking a Church Is About Exploiting Its Weakest Link

Bottom line: Staff training should be an ongoing part of church cybersecurity. Employees should know how attackers operate and what to do when something doesn’t look right.

One cybersecurity seminar isn’t enough—threats change and church volunteers often have access to the same systems that employees have–but without the same training

Churches should create what cybersecurity professionals sometimes call a human firewall.

That means building habits that make people part of the church’s cybersecurity defenses.

Church Law & Tax has documented how attackers can learn the rhythms of a church and use those routines against employees.

For instance, a fraudulent request appearing to come from a pastor can arrive shortly before a worship service—when staff members are busy and less likely to stop and verify it.

Training should address:

Most importantly, employees should feel comfortable slowing down a transaction.

A five-minute verification can be far less costly than recovering from fraud.

Go deeper: Church Cybersecurity Starts With the Human Firewall

Bottom line: Training alone won’t protect a church. Software updates, access controls, backups, and basic technology management have become equally important.

One significant trend deserves church leaders’ attention.

Verizon’s 2026 Data Breach Investigations Report  (DBIR) found that 31 percent of breaches began with exploitation of software vulnerabilities. For the first time in the report’s 19-year history, that surpassed stolen credentials as the leading breach entry point. 

In other words, the person using the computer isn’t always the vulnerability.

Sometimes the computer is.

AI is also helping attackers find and exploit weaknesses faster, according to Verizon’s analysis. 

Consequently, churches should regularly:

The FTC likewise recommends regularly updating security software, encrypting sensitive data, controlling access, and maintaining backups. 

Churches needing a broader framework can also use the NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide. NIST specifically says the resource can assist smaller organizations, including nonprofits. 

Go deeper: Is Your Data Security Up to Speed? A Checklist for Churches

Bottom line: Churches collect more sensitive information than leaders sometimes realize. Protecting that information requires knowing what the church has, where it is stored, and who can access it.

Think about the information flowing through a typical church.

It may include:

That information can create risk even without a sophisticated cyberattack.

For instance, something as routine as publishing a prayer request can raise privacy concerns.

Attorney and CPA Richard Hammar notes that churches can reduce the risk associated with public prayer lists by obtaining consent before identifying individuals and their needs online. Express consent is stronger than assuming consent because someone didn’t opt out. Cybersecurity and privacy, therefore, increasingly overlap.

Churches should ask:

Do we need this information?

Where are we storing it?

Who has access to it?

How long are we keeping it?

What happens if someone obtains it?

Those questions also matter after a breach.

The FTC notes that every state, the District of Columbia, Puerto Rico, and the Virgin Islands have laws addressing notification following certain security breaches involving personal information. Specific obligations depend on the information involved and applicable law. 

Therefore, churches experiencing a data breach should promptly consult qualified legal and cybersecurity professionals about their response and notification obligations.

Go deeper: Are Public Prayer Lists an Invasion of Privacy?

Bottom line: Outsourcing technology doesn’t outsource risk. Churches should understand how vendors access, store, and protect church information.

Churches depend heavily on outside platforms.

Giving processors, payroll providers, accounting systems, church management platforms, email providers, background-check companies, cloud storage services, and other vendors may possess church information.

That creates another potential entry point.

The 2026 Verizon DBIR found third-party involvement in breaches increased substantially. Verizon reported that breaches involving third parties accounted for 48 percent of breaches in its dataset. 

That doesn’t mean churches should abandon cloud services. But it does mean vendor selection becomes a very important part of a church cybersecurity plan.

Before granting a vendor access to church systems or sensitive information, consider asking:

The FTC recommends including security requirements in vendor contracts and limiting vendor access to only the information needed to perform the work. 

Bottom line: A general liability policy should not be assumed to cover cyber incidents. Churches should review available cyberliability coverage and understand exclusions, limits, and conditions.

Even strong cybersecurity cannot eliminate every threat, which is why cyberliability insurance should be considered..

Cyber coverage can address expenses that traditional insurance may not cover.

Depending on the policy, first-party coverage can potentially address costs involving:

Third-party coverage can potentially address liability arising from claims made by others after an incident. 

However, policies differ considerably.

Church Law & Tax’s review of cyberliability insurance also cautions churches against assuming their general liability policy covers cyber-related claims. Coverage limits, exclusions, premiums, and policy requirements all deserve careful attention. 

Before purchasing or renewing coverage, ask the church’s insurance professional:

Insurance transfers some financial risk. It doesn’t replace prevention.

Go deeper: Navigating Cyberliability Insurance

Church leaders don’t need to become cybersecurity engineers. However, they should know whether fundamental safeguards are in place.

Cybersecurity doesn’t have to begin with an expensive new technology platform.

Start by identifying the church’s most important information and systems. Then determine what would happen if those systems became unavailable or that information was stolen.

From there, prioritize the biggest risks.

Churches face risks from phishing, social engineering, compromised credentials, software vulnerabilities, ransomware, data breaches, and third-party vendors. AI is also helping attackers create more convincing scams and accelerate some attacks. 

MFA is one of the foundational cybersecurity practices recommended by both CISA and the FTC. Churches should strongly consider requiring it for systems containing financial, personal, administrative, or other sensitive information. 

A church should evaluate its specific cyber risks with a knowledgeable insurance professional. General liability insurance should not automatically be assumed to cover cyber incidents, and cyber policies vary in their coverage, exclusions, and limits. 

Start with the fundamentals. Identify critical systems and sensitive data, require MFA, update software, use strong unique passwords, maintain backups, train staff, review vendor access, and establish an incident-response plan. The NIST Cybersecurity Framework provides a structured approach built around Govern, Identify, Protect, Detect, Respond, and Recover. 

Church cybersecurity risks are changing, but the fundamentals remain remarkably consistent. Protect accounts, update technology, train people, safeguard sensitive information, evaluate vendors, prepare for incidents, and understand your insurance. Most importantly, church boards and leaders should treat cybersecurity as an organizational risk—not simply something delegated to the person who manages the computers.

This resource was created with a combination of AI and human review.