Cyber security training for schools protects the people who hold the most sensitive data in a school: teachers, front-office staff and finance teams who handle student records, parent contact details and fee payments. Schools have small IT teams, high staff turnover, seasonal pressure at term start and a constant flow of email from parents and vendors. This guide covers the threats, the modules that matter and a cadence that fits a school calendar.
TL;DR
- Schools are targeted for student records, parent details and fee payments, not for their devices.
- Five modules cover most of the risk: phishing, invoice and fee fraud, student data handling, password and sign-in hygiene, and safe use of personal devices.
- Short monthly lessons fit the school calendar better than one long session.
- New staff each term should be enrolled automatically.
- Keep completion records for governing bodies and insurers.
Why schools are a target
The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024-25, an average of one every six minutes (ASD Annual Cyber Threat Report 2024-25). Schools combine valuable data with limited security resources. A single compromised staff account can expose student records, and a fake invoice can redirect a payment meant for a supplier.
The threats staff actually meet
Phishing to staff accounts. Emails pretending to be IT, the principal or a parent ask staff to sign in to a fake portal.
Invoice and fee fraud. A supplier or parent appears to change bank details before a payment run.
Student data exposure. Reports emailed to the wrong person, shared folders open to everyone and files saved on personal devices.
Weak sign-in habits. Shared logins, reused passwords and missing multi-factor authentication.
Personal devices and public Wi-Fi. Teachers work from home, on trips and on their own phones.
The five modules that matter
| Module | Why it matters in a school |
|---|---|
| Phishing and fake sign-in pages | The most common way into a staff account |
| Invoice and fee fraud | Protects supplier and tuition payments |
| Student data handling | Reduces misdirected email and over-shared files |
| Passwords and sign-in | Cuts the risk from reused or shared credentials |
| Personal devices | Covers work done at home and on excursions |
A cadence that fits the school year
- Baseline in term one. Run a first phishing simulation to see who clicks and who reports.
- One short lesson a month. Five to ten minutes, assigned on a schedule, fits between classes.
- Auto-enrol new staff. Casual and relief staff are easy to miss; syncing from Microsoft 365 or Google Workspace picks them up on arrival. Cyber Aware's security awareness training supports this.
- Simulate each term. Use lures staff recognise: a parent request, a vendor invoice, an IT password notice via phishing simulations.
- Report to leadership. Human risk reporting turns clicks and overdue lessons into one score per person and exports PDFs for the principal or board.
Measuring progress
Track three numbers: completion rate, the share of staff who report suspicious email and the click rate on simulations. If completion is high and clicks fall term over term, the programme is working. A short gap assessment can also show where basic controls are missing.
FAQ
How often should school staff do cyber security training? Monthly short lessons with at least one phishing simulation per term.
Do casual and relief teachers need training? Yes. They have the same access to email and student data and are often the least prepared.
What is the biggest risk for a school? A compromised staff account that exposes student data, closely followed by payment fraud.
How do we show governors the programme works? Export completion records and a risk trend as a PDF each term.
One last thing
Pick one staff meeting this term and run a ten-minute phishing example. It costs almost nothing and starts the habit.