Community IT Innovators Nonprofit Technology Topics · Community IT Innovators

Vulnerability Scanning for Nonprofits with Johan Hammerstrom

July 18, 2025·28 min·2 clips

Johan explains why vulnerability scanning is becoming a must-do for nonprofits facing insurance and audit demands.

This episode of the Community IT Innovators podcast features host Carolyn Woodard interviewing CEO Johan Hammerstrom about vulnerability scanning for nonprofits. Hammerstrom explains why this technical practice is increasingly required for organizations. He states vulnerability scanning is now appearing in cyber liability insurance applications and annual financial audit questions. Nonprofits also encounter it during cybersecurity assessments and within compliance frameworks like FISMA and HIPAA. The process involves using software to systematically check networks, websites, and systems for known security weaknesses. These weaknesses, or vulnerabilities, are cataloged in public databases like the CVE list. Hammerstrom clarifies that scanning simply identifies problems but does not fix them. Effective scanning requires proper configuration, regular scheduling, and knowledgeable review of the results. He distinguishes between internal scans, run from inside the network, and external scans, which probe from the internet. A key insight is that scanning one's own website externally is crucial, as it mirrors how attackers would view it. Hammerstrom notes that many organizations are surprised to learn their internet-facing assets have vulnerabilities. He emphasizes that scanning is a proactive measure to find issues before attackers exploit them. The conversation reveals that insurance companies and auditors are now driving adoption by making it a standard question. Hammerstrom suggests starting with free or low-cost scanning tools available from reputable security organizations. The tone is educational and conversational, aimed at demystifying a technical subject for nonprofit leaders and IT staff. Listeners seeking to understand new cybersecurity expectations from insurers and auditors will find this episode valuable. Nonprofit staff responsible for IT compliance or risk management would gain practical next steps. Those looking for highly technical implementation details or advanced threat analysis might find the discussion too introductory.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Community IT Innovators Nonprofit Technology Topics