Start from a trigger, not a calendar.
When one of these is on the horizon, you have a concrete reason to test. Each points to a starting service.
Weigh what is at stake.
What data or systems are involved, and what would a breach mean for safety, privacy or continuity? Three consequences matter most to a school.
Operational continuity
Ransomware that freezes administration, finance and teaching. If the network stops, the school stops.
Data privacy
Breaches of minors' personal information, medical records or family financial data. A failure of trust and regulatory obligation, not just a technical incident.
Identity compromise
Phishing that targets staff to take control of Microsoft 365. Identity is the new perimeter.
The point of testing is to confirm controls such as MFA and segmentation hold under pressure, not to tick a compliance box.
Find the service.
Ten services in five risk domains, each with what LITE and EXTENSIVE cover.
Student data & platforms
Risk: unlawful access to family data or medical records, grade tampering, data leaking through third-party APIs.
Web application
Parent portals, student management systems, learning and payment platforms.
Strategic investmentBlack-box scan of public URLs; automated and targeted manual checks of key endpoints.
Authenticated areas, business logic flaws, OWASP Top 10, API and integration testing.
Web services (API)
Integrations with EdTech, mobile apps or government systems.
Scale to riskSurface-level API endpoint scanning and basic fuzzing.
Full schema logic testing, auth fuzzing, chained exploits and session handling.
Perimeter & internal network
Risk: ransomware through exposed services, a compromised student device pivoting to admin servers, malware spreading across campus.
External network
VPNs, remote access portals and public servers.
Must doScan perimeter hosts and services for exposed vulnerabilities.
Deep enumeration, simulated adversary attacks, pivoting and credential discovery.
Internal network
A compromised device spreading across the network.
Scale to riskScan from one or two segments to highlight obvious misconfigurations.
Lateral movement, privilege escalation and segmentation bypass, such as Classroom VLAN to Finance VLAN.
Identity
Risk: total network takeover through compromised staff credentials, escalation to Global Admin with full data access.
Active Directory
On-premises or hybrid identity for staff and students.
Scale to riskLimited-scope domain configuration review and basic attack paths.
Full domain compromise simulation, Kerberos abuses, lateral movement and persistence.
Microsoft Entra ID
Microsoft 365, cloud learning platforms and SSO.
Strategic investmentTenant configuration, conditional access and MFA enforcement.
Token abuse, conditional access bypass, Entra role escalation and hybrid identity paths.
People & information leakage
Risk: staff clicking phishing links, a primary ransomware vector, and impersonation built from public staff details.
Social engineering
Staff resilience to phishing, impersonation and scams.
Must doPhishing simulation with a small sample.
Multi-vector tests (email, phone, physical) and targeted spear-phishing.
OSINT
What school information is publicly exposed.
Context dependentBasic reconnaissance and public information mapping.
Targeted profiling, deep web scans and actionable attack vectors.
Emerging tech & devices
Risk: data exposure through AI models or chatbots, malware spreading across thousands of student laptops.
AI testing
AI learning tools, chatbots and analytics platforms.
Context dependentStandard prompt fuzzing and model behaviour testing.
Adversarial input testing, model poisoning checks and inference leakage analysis.
Endpoint resilience
Large student and staff device fleets.
Scale to riskBasic endpoint configuration and malware vector checks.
Full attack simulation across the fleet, including EDR and AV efficacy testing.
Choose LITE or EXTENSIVE.
“Are the doors locked?”
Obvious holes, misconfigurations and known vulnerabilities. Baseline assurance, regulatory checks, early maturity.
“Can a skilled burglar pick the lock?”
Logic flaws, lateral movement and chained exploits. For high-risk environments, post-incident assurance and crown-jewel data.
External network and social engineering, LITE. Every school. The front door, and your people.
Entra ID and critical web apps, EXTENSIVE. For schools holding crown-jewel data in the SIS or parent portal.
AI testing and OSINT. Only when you are rolling out AI tools, or a project trigger calls for it.
Or start from a ready-made pick
Baseline assurance
A cost-effective first step: the front door, your people and your device fleet.
Critical protection
Depth where grades, medical data and identity live; the internal network stays at maintenance level.
From request to retest
- 01Pricing card to your inbox.
- 02We confirm scope, depth and final price.
- 03Signed engagement letter and testing window.
- 04Testing, then a report for leadership and ICT.
- 05Retest within 7 business days of your fixes (time and materials).
Have this ready for scoping
- URLs, endpoints and network segments in scope
- Credentials for authenticated testing
- Microsoft 365 / Entra tenant details
- Device fleet size
- Technical and authorising contacts
- Testing window, blackout dates and sign-off