Phishing attacks are evolving, but schools can fight back

Key points:

The education sector has become an increasingly lucrative target for threat actors, not only because of the valuable data schools hold–student records, login credentials, Social Security numbers, and financial details–but also because of the widespread disruption a successful attack can cause.

The 2025 CIS MIS-ISAC K-12 Cybersecurity Report underscores this point, noting that the fallout from such attacks extends far beyond data theft. Lost learning time, canceled classes, and prolonged operational downtime can be just as damaging to schools and students as the initial breach.

Recent research from the Zscaler ThreatLabz team revealed a 224 percent increase in attacks on the education sector in 2024. And the attacks are not just more frequent–they’re more sophisticated and targeted, designed to exploit resource gaps and maximize disruption. 

How phishing attacks have changed

Instead of relying on mass email campaigns, threat actors are now weaponizing generative artificial intelligence (GenAI) to develop interactive and immersive phishing techniques that target the human element. With tools for audio and video manipulation now easily accessible, threat actors can impersonate trusted individuals with startling accuracy. With just a few publicly available details, GenAI can generate a tailored message, simulate a trusted sender, or even produce voice and video content that mimics school staff or vendors.

Other tactics such as cloned Google forms, spoofed portals, and multi-step payment redirection schemes are also often deployed and typically timed around peak academic seasons when vigilance is low and digital activity is high. Phishing campaigns focusing on financial aid scams, tuition adjustment emails, and cloned portals for student/faculty logins are only set to surge as schools increasingly digitize services.

Despite these advancements, there are steps that the education sector can take to protect itself, including moving away from outdated defenses and legacy security tools such as VPNs and moving towards a zero trust architecture with AI-powered phishing prevention controls.

Schools must reinforce cybersecurity with zero trust

First, cyber resilience isn’t just about preventing breaches–it’s about ensuring that critical information remains secure and that operations can continue after an attack. Traditional security measures that are reliant on perimeter defenses struggle to inspect encrypted traffic at scale, creating potential blind spots.

Moreover, education networks are designed with an open architecture to promote information sharing. The rise in today’s digital and hybrid world has further complicated matters because students and teachers can access networks from anywhere, at any time, on any device. These environmental factors expand the attack surface, giving threat actors more opportunities to infiltrate the network. Once inside, attackers don’t stop–they seek to move laterally across systems, targeting critical assets.

To compensate, institutions must implement a zero trust architecture, a security approach that mandates continuous verification and strict access control based on the assumption that every user, device, and connection is potentially compromised. To put it simply: Nothing is trusted until it is authenticated and is verified at every layer of the network. If a bad actor were to slip through that first line of defense, the security layers within the network hinder lateral movement to minimize damage. 

While implementing zero trust may seem daunting to resource-strapped institutions, it doesn’t have to be. Institutions can adopt a staggered approach, taking small yet strategic steps: identifying critical assets and pain points, prioritizing data sets, and implementing elements of the zero trust framework incrementally without overhauling all systems. This can be done by adopting a unified, cloud-native zero trust security platform that sits on top of existing technology. Traffic flows into and out of the network after passing through the security platform.

By embracing this phased approach, institutions will realize that zero trust is not a one-time initiative or a single technology solution–it’s an ongoing journey toward stronger security.

Combining zero trust and AI-powered phishing controls

While AI has increasingly been adopted by threat actors, it can also help institutions stay ahead. AI-powered detection engines can analyze behavioral patterns across email, web traffic, and messaging platforms–identifying threats that traditional, signature-based systems miss. When paired with zero trust, AI-driven tools provide continuous visibility and control, flagging unusual activity before it leads to data theft or downtime.

Combining phishing-resistant authentication methods with zero trust further increases security defenses and reduces the risk of attacks turning into operational downtime, missed school days, and financial losses.

Students can protect their data, too

Ultimately, no technology can replace human vigilance, and with phishing attacks striking the human element, curious and capable students can very well be the target of an attack. Institutions have no choice but to stay prepared and prioritize improving their security posture.

Schools can provide regular training on how to spot suspicious emails, inspect sender addresses, and identify proper URLs. Multifactor authentication (MFA) should be mandated wherever possible, and students should be encouraged to use strong, unique passwords and keep their software updated.

When everyone understands the threat landscape and knows how to respond, institutions can create a culture of cyber resilience.

Phishing attacks are here to stay

The education sector must recognize that the threat from phishing attacks is not theoretical–it is immediate and growing. Adapting cyber protections by implementing a zero trust architecture with AI-powered phishing prevent controls, and by engaging in trainings, educational institutions can better protect their data, safeguard operations, and ensure learning goes uninterrupted. They can fight back–and emerge more resilient.