The Challenge
The school holds exactly the kind of information attackers prize: student and family records, health and welfare notes, and the finance systems that process fees and payroll. Like most independent schools, it had adopted cloud-based learning platforms quickly, and its digital footprint had grown faster than the small IT team could assess.
Education has become a favoured target for ransomware and credential-theft campaigns, in part because term-time pressure makes schools more likely to pay to restore services. Staff ranged from technology specialists to teachers with little security training, which widened the human attack surface. Leadership wanted an honest picture of where the school stood, framed against its privacy obligations for the young people in its care, and a clear roadmap to a defensible level of maturity.
Our Approach
StrikeCyber scoped a right-sized programme that combined technical testing with a maturity assessment, so the school could see both its immediate exposures and how it compared to peer institutions.
- Reconnaissance across the school's public footprint using StrikeCyber's autonomous reconnaissance, part of our AI-augmented offensive security platform, to surface exposed services, leaked credentials and OSINT that an opportunistic attacker would find first.
- Penetration testing of internal and external networks and the cloud-hosted learning environment, checking access controls, identity management and segregation between staff, student and finance systems.
- A controlled phishing simulation targeting staff, paired with a maturity-level assessment mapping current controls against recognised baselines.
Automated findings were validated by hand by expert operators to remove false positives, and results were delivered through a live client portal with AI-accelerated reporting written for a non-specialist audience.
What We Found
- Staff phishing susceptibility. A realistic email scenario showed a meaningful proportion of staff would click and submit credentials, and that recovered logins opened the online learning platform and email without a second factor.
- Weak segregation around student records. Broken access control and IDOR-style flaws in a web portal let a low-privileged account reach records belonging to other students, a direct privacy risk.
- Weak email security posture. Missing and misconfigured SPF, DKIM and DMARC records made the school's domain straightforward to spoof for parent-facing fraud.
- Flat network and shared credentials. Limited segmentation and reused local administrator passwords meant one compromised device could reach finance systems, a classic pre-ransomware condition.
The Outcome
The school received a prioritised, plain-language remediation plan and a maturity scorecard it could take to its board and finance committee. Multi-factor authentication was rolled out across email and the learning platform, the access-control flaws exposing student records were fixed, and email authentication was corrected to block domain spoofing. Network segmentation and a credential clean-up closed the path from a single infected laptop to the finance systems.
A follow-up retest confirmed the critical and high findings were remediated and verified, and a repeat phishing exercise showed a marked drop in click-through and a rise in staff reporting. The school moved measurably up the maturity scale and gained documented assurance that it was meeting its duty of care over student data.
Why It Matters
Schools carry enterprise-grade risk on lean budgets and volunteer-level security awareness. Testing that pairs technical depth with a maturity view, and that reports in language teachers and board members understand, lets a school spend its limited resources on the few fixes that most reduce the chance of a breach affecting children and families. To scope a right-sized programme for your school, get in touch.