Walk into a 3D lesson.Watch a learner go through the bar scenario, step by step.- Industries
- Education
Security awareness training for schools, colleges and universities.
Teachers work to the timetable, office staff handle parents' payments and researchers guard data worth stealing. Cyberfrog trains each group with short lessons and simulations that fit around teaching, and produces the evidence that DfE standards, GLBA and NIS2 ask for.
- Annual training, short refreshers
- Phishing, QR and MFA simulations
- Paths for staff, governors and IT
- Records for DfE, GLBA and NIS2
This term's grades must be confirmed in the new results portal before the moderation deadline on Friday at 16:00. Staff who have not signed in by then will have to re-enter their marks by hand.
Sign in to the results portal- The school name is spelt with a 1 instead of an l
- A deadline that lands in the middle of marking season
- A new portal that nobody mentioned in the staff briefing
What attackers send to schools and universities.
Schools and universities have large, changing user bases, open networks and a public staff directory. Phishing is how most attacks start, and attackers often write in the institution's own name.
- Phishing in almost every breach
Among UK education institutions that identified a breach, phishing affected 90% of primary schools, 96% of secondary schools and 96% of further and higher education institutions. UK Cyber Security Breaches Survey 2025/26
- Impostors using your name
79% of further and higher education institutions that identified a breach saw people impersonating the organisation or its staff, compared with 28% of businesses. UK Cyber Security Breaches Survey 2025/26
- Phishing as a way in
In education, phishing is 22% of initial access and credential abuse 8%, behind exploitation at 34%. The human element is involved in 68% of breaches. Verizon DBIR 2026
- Phone calls for cloud data
The victims of a vishing campaign against Salesforce customers, tracked as UNC6040, included education organisations. The Register, on Google threat intelligence findings, June 2025
Training for everyone on the staff list.
A teacher marking between lessons, a bursar paying suppliers and a researcher sharing data with partners face different lures. Cyberfrog gives each group its own path, timed around the academic year.
- Teachers and lecturers
Fake portal notices at marking time, QR codes on campus posters and file-sharing links that look like a colleague's.
- School office, admissions and finance
Messages from 'parents' with changed payment details, fake supplier invoices and requests for pupil or student records.
- Researchers and academic departments
Targeted lures about grants, conferences and collaborators, and the care that research data needs under NIS2.
- IT, leadership and governors
Help-desk reset requests and MFA fatigue, plus a short leadership course for heads, governors and trustees.
Lures that follow the academic year.
Simulations follow the calendar: term start, enrolment, exams and results. Every mistake leads straight to a short lesson on that exact trick.
- EmailResults portal sign-in
A fake notice in the school's name asks staff to confirm marks in a new portal before moderation.
- QRCampus Wi-Fi poster
A QR code on a corridor poster promises faster Wi-Fi and opens a cloned university sign-in page.
- MFAPush requests at term start
A burst of sign-in approvals during enrolment week, when staff expect extra prompts anyway.
- VoiceIT Services on the phone
An AI caller talks a member of staff through connecting a 'new' app to the student system.
Find the staff accounts already for sale.
Academic email addresses are public by design and end up registered on journals, conference sites and shopping accounts. When one of those sites leaks, or a home laptop catches infostealer malware, the login turns up in Darknetsearch's breach and stealer-log data.
Cyberfrog matches that data to your staff, sends each exposed person a private notice that says what was found and what to do, and assigns a short course on breaches and stealer logs. How much of a password appears is set by your privacy settings.
What the rules ask of schools and universities.
Education answers to different rules in each country. Cyberfrog keeps the same per-person records for all of them, so one programme can serve a school trust in England, a US college and a Swiss university.
| Rule | What it asks for | How Cyberfrog helps |
|---|---|---|
| UK DfE cyber security standards for schools and colleges | Cyber training at least annually, covering phishing, passwords and social engineering. Schools in the RPA must show NCSC training. | An annual programme with those topics and completion dates per person. It does not replace the NCSC training the RPA asks for. |
| US GLBA Safeguards Rule, 16 CFR 314.4(e) | Title IV institutions must comply with the rule (FSA GEN-23-09), which requires security awareness training for personnel. | Training and simulation records per person for financial-aid and student-finance staff. |
| US FERPA | Student-record privacy law with no explicit security-training article; schools use training to meet it. | Lessons on handling data and sharing files, with records your privacy office can show. |
| NIS2 Directive, Annex II (research)Mapped in Cyberfrog | Research organisations are in scope, and public universities may fall under public administration, depending on national law. | NIS2 coverage report and management training for university leadership. |
| Swiss Information Security Act, Art. 74b(a) | Universities must report cyberattacks to the NCSC within 24 hours. | Staff who recognise an attack and report it in one click from the inbox. |
| CISA report on K-12 cybersecurity | Recommends cyber training as part of the defence of resource-constrained K-12 organisations. | Ready-made lessons and simulations that take little staff time to run. |
Summaries for orientation, not legal advice. Cyberfrog provides training records and coverage reports; it does not certify compliance.
Questions from schools and universities.
Why are schools targeted by cyber criminals?
They hold personal data on pupils, students, parents and staff, run open networks with many users and often have small IT teams. In the UK, phishing was involved in at least 90% of identified breaches across every type of education institution.
How often should schools run cyber training?
The DfE cyber security standards for schools and colleges in England say cyber training should be given at least annually. Short refreshers at the start of each term and simulations in between keep the topic current.
Does GLBA apply to universities?
Yes, for institutions that take part in the US Title IV federal student aid programmes. Federal Student Aid confirmed in GEN-23-09 that they must comply with the GLBA Safeguards Rule, and section 314.4(e) of that rule requires security awareness training for personnel.
Is FERPA training mandatory?
FERPA has no explicit article that requires security training. Schools use training to protect student records and meet their FERPA duties, and the US Department of Education publishes resources for this at studentprivacy.ed.gov.
Can teachers fit training in during term?
Yes. Lessons start at about five minutes and run in any browser, so they fit into a free period. Simulations arrive during the normal working day and lead to a short lesson only when someone takes the bait.
Related industries.
- IndustryPublic sector
Calls posing as the authorities, AI voice messages from senior officials and ransomware that stops municipal services.
Read more - IndustryHealthcare
Ransomware that postpones care, help-desk calls that reset MFA, and staff who share workstations between shifts.
Read more - IndustrySaaS
Phone calls that get staff to approve a malicious connected app, stolen OAuth tokens and fake job applicants.
Read more
A programme that follows the academic year.
In a 30-minute demo we show a year of simulations and lessons for teaching, office and IT staff, on your own domain.