AegisAI Perspectives · 108
A school board should size email security spend against recovery cost: months of recovery and weeks of lost learning, then fund built-in controls first.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
A school board should size email security spend against the cost of recovery, not the price of a tool: GAO found recovery after a cyberattack took two to nine months3. AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to mail routing (MX records)17. Use the steps below to set a budget line the board can defend.
Put these three points on the agenda for the board's next budget session.
A cyberattack costs a district weeks of teaching and months of recovery. GAO found that ransomware attacks cost K-12 schools three days to three weeks of lost learning2, and recovery can take two to nine months. K-12 schools have reported considerable educational impact from cybersecurity incidents such as ransomware, according to GAO13.
Incidents are common. In a CIS survey, 51% of schools and districts reported a cyber incident in the past 12 months, with 34% reporting impacts to school operations9. Twenty-two percent reported disrupted classroom instruction, and 2% reported school closures5. Ask the superintendent to price one week of lost instruction and one month of recovery staff time for your district.
Short on time? Watch the explainer, or book a demo.
Email is where payment fraud starts, and payment fraud lands on the board's books. The FBI's IC3 recorded $2,770,151,146 in business email compromise losses in 20247, inside a record $16.6 billion of total reported losses. These are national reported figures, so quote them as a floor, not a forecast for your district.
The guide to email security for education covers the payroll and vendor scams that reach schools. Ask the business office how many payment change requests arrived by email last year.
Fund the free and built-in controls first. The built-in security features for all Microsoft 365 cloud mailboxes prevent broad, volume-based, known email attacks16. In the CIS survey, eighty-three percent of districts have deployed MFA and the same share filter email, while 59% keep an incident response plan14.
Recovery readiness trails blocking: fifteen percent of districts hold regular incident response exercises4. Fund MFA, email filtering settings and a tested incident response plan before any new email tool.
Staff hours decide what a district can run, so the budget line counts people as well as licenses. Sixty-six percent of districts have just one or two people responsible for cybersecurity10, and 11% have no dedicated security staff6.
A tool that needs daily rule writing costs hours those staff do not have. The guide to justifying an email security investment to a CFO shows how finance teams weigh tool cost against labor. Add the weekly review hours for each option to the budget line beside its license cost.
Outside money can cover part of the cost, but eligibility must be checked first. The FCC's three-year Cybersecurity Pilot Program, administered by USAC, provides up to $200 million to eligible schools and libraries for eligible cybersecurity services and equipment15.
Free help has also changed: as of June 23, 2025, the MS-ISAC introduced a fee-based membership11. Ask your E-rate contact whether your district is in the pilot before the board votes on the budget.
Work through these steps with the superintendent and the IT lead before the budget vote.
Price one week of lost instruction and one month of recovery, using GAO's ranges of three days to three weeks and two to nine months.
List the email controls already on, starting with MFA and email filtering.
Count the people who run security and their weekly hours.
Check pilot eligibility with your E-rate contact for eligible cybersecurity services.
Fund a tested incident response plan, since only fifteen percent of districts exercise one regularly.
Fund a new email layer only if a monitoring-mode trial on your own mail finds attacks the built-in controls delivered.
Record the cost of each step on one page, and vote on the total against the recovery cost from step 1.
Score built-in protection and an added API layer on the rows a board budget turns on.
| Criterion | Built-in Microsoft 365 or Google Workspace protection | AegisAI |
|---|---|---|
| Known, volume-based attacks | Prevented by built-in features for all cloud mailboxes | Reads mail after delivery through the API |
| Mail routing | Unchanged | No change to mail routing (MX records) |
| Trial before a budget vote | Settings review | Runs in monitoring mode first |
| Removal after delivery | Admin action per message | One bad email is pulled from every inbox it reached, forwards included |
| Staff time to read verdicts | Admin review | Every verdict comes with its reason in plain language20 |
| Incident response plan and exercises | No tool writes these | No edge: the plan and its exercises stay with your district |
Score your district on all six rows, and use the demo request page to arrange a monitoring-mode trial before the budget vote.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to mail routing (MX records). It runs in monitoring mode first, and removal needs write access your admin grants and can revoke. One bad email is pulled from every inbox it reached, forwards included. Mail keeps flowing, and detection pauses until the service returns22.
Illustrative example, figures are fictional. A district of 4,000 students has one IT director and one technician, like 66% of districts. The board prices one week of lost instruction and four months of recovery, inside GAO's ranges, at far more than a year of any email tool. It funds MFA for all staff, an incident response exercise and a 30 day monitoring-mode trial, and sets the tool decision for the next meeting.
Run your own district's figures through this scenario before the budget vote.
Track three numbers from the day the budget passes.
Report all three to the board on day 30, and keep funding only what moved them.
Weigh the spend against recovery cost: GAO found two to nine months of recovery and three days to three weeks of lost learning after attacks. Fund free and built-in controls first, then a new layer only on trial evidence.
GAO reported recovery times of two to nine months after a cyberattack on K-12 schools, and three days to three weeks of lost learning.
MFA and email filtering, which eighty-three percent of surveyed districts already run, then a tested incident response plan. Only fifteen percent of districts hold regular incident response exercises.
The FCC's three-year Cybersecurity Pilot Program provides up to $200 million to eligible schools and libraries for eligible cybersecurity services and equipment. Check with your E-rate contact which services qualify.
Sixty-six percent of districts have one or two people responsible for cybersecurity, and 11% have no dedicated security staff. Count their weekly hours in the budget.
