Overlooked Security Risks: Cloud Communications and VoIP for SMBs and Nonprofits

Recentcom Team
6 days ago
6 min read

Cloud communications and VoIP platforms have transformed how small and midsized businesses (SMBs) and nonprofits connect with customers, colleagues, partners, donors, members, and communities. Flexibility, mobility, and cost savings have made cloud-based phone solutions an essential part of modern operations.

But as organizations adopt more communication tools, many underestimate the security, privacy, and operational risks that come with them.

Although email security receives the most attention (still the #1 cause of breaches), voice, SMS/texting, collaboration tools, and cloud phone systems are increasingly targeted by attackers as they are frequently overlooked as a cybersecurity risk.

More Channels, More Risk

Today’s organizations communicate across more channels than ever:

Email (phishing)
Phone Calls (vishing)
SMS/Texting (smishing)
Video and Collaboration Tools
Social Media (impersonation, job change monitoring, relationship mapping)

Every new way to say “hello” is also a new opportunity for attackers.

Did you know, 98% of all cyberattacks involve some form of social engineering exploiting human trust rather than technical vulnerabilities.

AI and the Evolution of Social Engineering

Cyber threats are evolving rapidly, fueled by artificial intelligence:

AI-driven social engineering attacks are becoming more sophisticated
AI-generated phishing messages increase success rates by 30–40%
Voice cloning and deepfake audio make fraudulent phone calls harder to detect
Internal impersonation attempts leverage trust, authority, and familiarity

For nonprofits and SMBs, where staff often wear multiple hats and move quickly, these attacks can be especially effective.

Why SMBs and Nonprofits Are Prime Targets

Small and midsized businesses and nonprofits consistently rank among the top sectors targeted by cyberattacks.

Common factors include:

A mix of in-office, hybrid, and remote staff
Limited internal IT and security resources
Overlooked importance of security tools and trusted partners
Lack of ongoing training and technology adoption
BYOD (bring your own device) environments
Budget constraints that limit advanced security investments
Legacy or lightly configured cloud communications platforms

Attackers understand that these organizations often rely on trust, speed, and accessibility, all of which can be exploited.

Rewards & Risks of Remote Work

Cloud communications enable remote and hybrid work, but they also expand the attack surface.

Rewards

Secure, flexible access to communication tools
Business continuity during disruptions
Scalability without on-prem hardware
Improved work-life balance and productivity
Centralized cloud security controls (when configured correctly)

Risks

Staff using personal devices when secure tools aren’t provided
Insecure home or public networks
More endpoints, logins, and devices to protect
Phishing, vishing, and smishing are more effective when users are isolated
More tools to manage can mean more gaps
Limited IT resources slow patching, monitoring, and response

Cloud communications can reduce infrastructure burden, but only when security and governance keep pace.

The Benefits of Cloud Communications & VoIP

When designed and managed correctly, cloud communications offer significant advantages:

Future-Ready & Budget Friendly
No on-prem hardware or upgrade costs. Updates, security patches, and new features are included in predictable monthly pricing.
Flexible for Hybrid Work
Communicate from anywhere on any device including desk phones, mobile apps, or computer softphones.
Reliable & Resilient
Geo-redundant hosting and built-in failover help maintain communications during outages or emergencies.
Secure & Compliant
Enterprise-grade encryption and standards such as SOC 2, HIPAA, PCI-DSS, and ISO 27001 help protect sensitive data.
Easy to Manage
Web-based administration reduces IT burden and simplifies day-to-day changes.

The 6 Most Overlooked Risks of Cloud Communications

Despite the benefits, organizations often underestimate key risks.

1. Security & Fraud Exposure

Without strong controls, attackers can exploit phone systems just like email. Common threats include:

VoIP toll fraud
Call spoofing and manipulated caller ID
Account takeovers due to weak passwords or lack of MFA
Voice phishing (vishing) and SMS phishing (smishing)
Use of personal cell phones that expose private numbers and access paths

2. Privacy Risks

Calls, voicemails, call recordings, transcriptions, and text messages may contain:

Payment and financial information
Health or case-management data
Personally identifiable information (PII)

Without proper retention, access controls, and compliance settings, organizations risk privacy violations and loss of trust.

3. Responsibility Gaps

A reliable VoIP provider should:

Secure the cloud platform and voice traffic
Configure and secure phones, firewalls, switches, and related devices
Maintain appropriate certifications and FCC compliance

The SMB or nonprofit is responsible for:

Reliable and secure infrastructure (internet, power, cabling, internal IT hardware)
User access, permissions, and device security policies

Misunderstanding where responsibilities begin and end can leave critical gaps.

4. Call Quality & Continuity

Cloud communications depend on many variables:

Internet, Wi-Fi, LAN, cellular service, and power
Provider uptime and redundancy
Network configuration and traffic prioritization

Any cloud provider can experience outages. For mission critical calls, organizations should consider redundancy and provider diversity.

Without a continuity plan, outages can disrupt:

Customer service and technical support
Crisis or hotline services
Fundraising and donor engagement
Community response efforts

5. Compliance & Governance Challenges

Organizations subject to HIPAA, PCI-DSS, or state privacy laws face risk if:

Call recording is enabled without proper consent
Data is stored longer than policy allows
SMS is not registered with 10DLC
Vendors lack required audits or certifications
Providers are not FCC compliant (E911, STIR/SHAKEN, USF contributions)

Many compliance failures stem from provider expertise and configuration, not the technology itself.

6. Shadow IT & User Behavior

Cloud platforms make it easy for users to:

Access systems remotely
Use personal devices
Share logins
Forward calls externally
Access sensitive caller data

Without training and clear policies, convenience becomes risk.

5 Keys to Reducing Communications Risk

Understanding risk is only part of being prepared. As your organization evaluates the current solutions and explores potential new options, here are 5 keys to reduce communications risks.

Understand Platform Reliability & Security
Ask current and potential VoIP providers questions about architecture, uptime history, encryption (TLS/SRTP), troubleshooting access, and security responsibilities.
Select the Right VoIP Provider
Ask about experience, security controls, technical support resources and response times, and overall approach to support your goals especially if phone calls are critical to your organization's success.
Protect Data with Policies & People Alignment
Whether keeping your current communications solutions and provider in place or making a change, be sure to define clear rules for:
- System access based on roles and visibility
- Ability to use tools and capabilities part of the cloud system (portal, mobile app, softphone, SMS, call recording, call reporting)
- Determine if call data should be retained (call recordings, voicemails, call reports)
- Understand industry standards for call data access and retention
Communications Continuity
Whether a power or internet outage, hardware failure, or VoIP provider outage, if phone calls are critical to your organization's success, a communications continuity plan should be in place.
- Identify outage risks
- Understand failover options
- Proactively enable failover options
- Consider provider diversity (Our team offers call continuity solutions with Recent Re-Route)
Empower Staff Through Training
If you are evaluating new VoIP platforms and providers, ask about training and onboarding. Do they offer hands-on and tailored training programs, or do they send links to a resource center for DIY training?

- Provide training on system use based on roles and access
- Mobile tools available and best practices for use when working remote r
- Understand and recognize phishing, vishing, and smishing attempts
- Proper handling of voicemails and call recordings

VoIP and Cloud Communications Security Is Not the Same as IT Cybersecurity

For SMBs and nonprofits, cloud communications can be mission critical. Phone calls, texts, and collaboration tools are often the front door to your organization, and a growing target for attackers.

Because our team at Recent Communications has over 25+ years of experience as a dedicated experts designing, deploying and supporting reliable, flexible, and secure cloud communications and VoIP solutions, we build amazing partnerships with our client's IT resources offering:

Partnership-focused care and expertise expected from fellow trusted technology companies
Elimination of ‘finger pointing’ when technical issues arise with our teams seamlessly working together behind the scenes
Expertise and resources to implement and support reliable, secure, and future proof solutions

So Now What?

Understanding overlooked risks and partnering with a trusted communications provider, organizations can protect their people, data, reputation, and revenue without sacrificing flexibility or accessibility.

About Recent Communications, Inc.

Trusted for over 25 years, Recent Communications, Inc. is a regionally-based, family-owned business communications company dedicated to designing and supporting reliable, secure, and flexible business phone solutions.

Our client-focused and consultative approach pairs industry expertise with white-glove service offering custom solutions, on-site implementation, and tailored training programs. Our responsive, expert support and a partnership-first mindset is key to client loyalty and lasting relationships.