Choose email security for universities and K-12 schools by what it catches in staff mail and how little work it adds: 51% of schools and districts reported a cyber incident in the past 12 months¹. The criteria below apply the same way on Google Workspace and Microsoft 365. AegisAI is one example of the API approach, and it reads mail through either platform's API after delivery²².

What you can do by the end

Which threats should school email security stop first?

Start with the attacks that move money or hand over accounts. In the same CIS survey, 34% of schools and districts reported impacts to school operations from cyber incidents². The FBI names education first among the sectors most affected by payroll diversion phishing⁴.

Business email compromise is the second threat to rank. The FBI received 24,768 business email compromise complaints in 2025⁸, with reported losses of $3,046,598,558. A school pays vendors and staff by email request every week, so both threats reach the business office.

Check how much staff time the tool needs

Pick a tool that a one or two person IT team can run without a security operations center. The CIS report found that 66% of districts have just one or two people responsible for cybersecurity³. A tool that sends every suspicious message to an admin queue moves the work to those people.

Count the queue in a trial. Record how many messages per week need a human decision, and who makes it when the IT lead is at a board meeting.

Question to ask a vendor: in a trial on our tenant, how many messages per week needed a human decision, and what did each one show the reviewer?

Check what your email platform already does by default

Read your own tenant's defaults before you buy anything, because both platforms ship protections that a school may not have turned up. In Gmail, Keep email in inbox and show warning is the default for each spoofing option¹⁰. Gmail can also flag look-alike domains and outside messages that use a name from your directory. Security Sandbox scanning can delay message delivery by up to 3 minutes¹².

In Microsoft 365, the built-in protections for all cloud mailboxes are included and are on by default¹³. Impersonation settings exist only in Defender for Office 365¹⁴, and no sender addresses are protected from impersonation until an admin adds them. Zero-hour auto purge searches only the last 48 hours of delivered email¹⁶.

The platform pages go further: see how to choose email security for Google Workspace and how to choose email security for Microsoft 365.

Question to ask a vendor: which threats did your trial find in mail our platform had already delivered to the inbox, with each default setting left as it was?

Ask how the tool catches payroll diversion

Ask the vendor to show the mailbox rule, not only the phishing email. In payroll diversion, the attacker adds rules to the employee's email account so the employee does not see alerts about the direct deposit change⁵. A filter that reads only inbound messages misses that step, because the rule is set from inside a signed-in account. The page on how email account takeover works shows the full chain.

Question to ask a vendor: do you alert on a new inbox rule that hides or deletes messages from the payroll or HR system?

Ask how the tool handles a change of bank details

Ask what the tool does with a message that asks to change where money goes. Business email compromise caused an exposed loss of $55,499,915,582 between October 2013 and December 2023⁶. The FBI advises using secondary channels or two-factor authentication to verify requests for changes in account information. A school's business office needs a written callback rule for vendor and payroll changes, and the tool should flag the request so the rule gets used.

Question to ask a vendor: when a vendor asks to change bank details by email, what does the business office see on that message, and why?

Ask what the provider can do with student records under FERPA

Treat the provider as an outside party with access to education records, and put its limits in the contract. FERPA lets an outside party act as a school official only if it is under the direct control of the school with respect to the use and maintenance of education records¹⁷. The school must also use reasonable methods so officials see only the records they have a legitimate educational interest in. FERPA requires written consent that is signed and dated before any other disclosure¹⁹.

Staff email carries grades and accommodation letters, so an email security tool reads education records as part of its work.

Question to ask a vendor: what do you store from our mail, who on your side can open it, and how do we confirm deletion when the contract ends?

Check how the tool fits your CIPA email safety policy

Map the tool to the email part of your internet safety policy before the next E-rate filing. Under CIPA, that policy must address the safety and security of minors when using electronic mail²⁰. CIPA compliance documents must be retained for at least 10 years. Ask how long the tool keeps its verdict logs, and whether you can export them into your own records.

Question to ask a vendor: can we export every verdict and removal log for student mailboxes, in a format our records office can keep?

Which approach to school email security meets each criterion?

Run this checklist before a trial

Answer each item yes or no, with evidence from a trial on your own tenant.

How AegisAI handles this

AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, so the MX records stay as they are. It starts in monitoring mode, and removal needs write access your admin grants and can revoke²³. It pulls a confirmed threat from every inbox it reached, forwards included. Each verdict comes with its reason in plain language. It takes about five minutes to connect, and a trial on your own tenant shows results in five days.

How to measure it in 30 days

Track three numbers from the first day of the trial.

Questions people ask

Sources