Need to leave this site fast? Press Esc twice, or tap Quick exit. It opens a weather page in place of this one. It does not erase your history; here is how. Quick exit

Case study · Funder-sponsored grantee network · 2025 to 2027

Fourteen movement organizations. 57% felt exposed online. Here is what changed.

A national philanthropic intermediary asked us to help the small organizations it funds get safer online. They are Black-led, LGBTQ+-led, disability-led, and justice-focused groups, most with 6 to 50 people and little or no tech budget. We ran four live trainings for the network in 2025, then moved to one-on-one coaching for a smaller cohort in 2026.

The funder and the organizations are not named on this page. That is their call, not ours, and we keep it. Everything below is aggregate or has written consent.

Training materials laid out on a table

Where they started

Pre-session survey, 14 organizations, September 2025. Aggregate only; no organization is identifiable.
Confidence57% rated themselves a 1 or 2. Nobody picked 5.
36%121%229%314%40%51 = highly vulnerable · 5 = fully confident
Already happened to themPhishing had already reached 71%.
Phishing or impersonation71%Online harassment or hate campaign43%Surveillance or monitoring29%Misinformation targeting their work21%Malware or ransomware14%Doxxing7%
What they asked forThree topics tied at 86%.
Organizational incident response86%Secure messaging (Signal, Proton)86%Securing social media accounts86%Personal digital privacy79%Countering misinformation71%Doxxing risk and response71%Personal digital emergency plan64%VPNs57%Passwords and password managers50%

How the numbers shaped the training

We did not teach what we planned to teach. We taught what the survey said.

57% at a 1 or 2

So we started at the foundation, not the advanced track: four habits anyone can keep, and a fourth session built entirely around raising confidence, not adding tools.

71% already phished

So “Confirm authenticity” led every session, with live examples from their own inboxes, and the incident plan became the first deliverable instead of the last.

43% harassed, 29% surveilled

So doxxing defense and footprint cleanup got their own session, and we moved sensitive conversations to secure messaging before anything else.

“Talk it through, then give us a guide”

So every session was 60 minutes of content and 30 of live help, and every organization left with a one-page step-by-step guide, not a slide deck.

One write-in summed up the whole room:

What we did

July 2025 · Session 1

Digital resilience for LGBTQ+ leaders

Doxxing, anti-queer and anti-trans misinformation, and how to shrink your footprint before someone goes looking. 60 minutes of content, 30 minutes of hands-on help.

August 2025 · Session 2

Our stories, our security

AI, intersectional justice, and shared vulnerabilities. How the same tools that surveil communities can be understood and pushed back on.

September 2025 · Session 3

Collaborative help session

Built from the survey above. Incident response, secure comms, social media lockdown, and personal privacy, worked live with the organizations in the room.

November 2025 · Session 4

From vulnerability to strength

A practical exercise to raise digital confidence, delivered with ASL and Spanish interpretation and live captions.

The method

Every session and every coaching plan runs on our 4C model: Control exposure, Create strong credentials, Confirm authenticity, Clean up digital footprints. Four verbs an organizer can remember under stress.

Then one-on-one

In June 2026 the funder brought us back for a year of direct coaching with a small cohort: an intake and threat-modeling call, working sessions, and a short “Security practices we can actually keep” document each organization co-writes with us and owns.

Accessible by default

Interpretation, captions, low-bandwidth materials, screen-reader friendly templates, and confidentiality for sensitive work. Organizers should not have to ask for these.

What changed

Coaching cohort runs June 2026 to May 2027. Figures fill in as the tracker closes.

Figure to come

Average 4C confidence score, intake to close, across the cohort.

Figure to come

organizations with MFA on every key account and a password manager in use.

Figure to come

organizations that completed a self-doxing cleanup and moved sensitive conversations to secure messaging.

Figure to come

organizations with a named security champion and a written practices document they own.

In their words

Quote to come. We publish testimonials only with written consent.

Role and organization type

Quote to come, with written consent.

Role and organization size

Quote to come. We publish testimonials only with written consent.

Role and organization type
Why there are no names on this page. These organizations are targeted because of who they are and what they do. Naming them next to the words “digital security” would hand an adversary a map. The funder stays unnamed by agreement. We would rather have a page with no logos than a client with a new problem.

What this means if you run a small organization

You are probably in the same place these fourteen were: phishing has already found you, confidence is low, and nobody has time. The fix is not a product. It is four habits, a plan for the bad day, and someone to call. That is what the Clinic does, and a funder can sponsor it for a whole network at once.

A row of padlocks used in a training exercise

Fund a network, or protect your own organization.

Talk to us about your organizationAll testimonials

How you can help

Fund the next cohort of organizations.

Most of the organizations in this story could not have paid for this work. A funder did.

Hire a graduateOr bring us in to help your organization. Mentor a studentOne hour a month. We train you. Give100% reaches us. Zeffy covers the fees.

Our team's experience spans

NASA
U.S. Air Force
U.S. Space Force
Slack
Salesforce
Fairfax County Public Schools
Pluralsight
TransTech Social Enterprises

Where our work has taken us