Phishing defense for school districts: staff report a suspicious email with one click, and we pull it out of every inbox.
Your staff are the target. We train them, and when something slips through we remove the real thing everywhere it landed — read, unread, forwarded or filed.
How it works
From reported to removed, usually before it spreads.
One button in Outlook or Gmail. No forwarding, nothing to remember. We ask whether they clicked or entered a password, without blame.
Headers, links, attachments, sender authentication and reputation. The verdict is evidence-based, not a guess.
We search every mailbox in the district to establish the true blast radius. One report rarely means one recipient.
Quarantine or delete everywhere in one action, reversible if it turns out to be legitimate. The reporter is thanked. Your team is told.
Inside BlueHook
One reported email, start to finish.
Seven minutes on a Tuesday morning. The front office clicks one button; everything after that is us.
I’m stuck in a meeting and need you to pick up four $100 gift cards for a staff appreciation thing today. I’ll reimburse you. Send me the codes when you have them.
The button is in Outlook and Gmail. No forwarding, nothing to remember.
- ×Sender domain is gmail.com, not the district. Display name borrowed from the principal.
- ×Urgency, secrecy and gift cards: the three tells of a payroll-style scam.
- ×Reply-to points at a second mailbox registered 3 days ago.
- ✓Search of every district mailbox: the same message reached 4 other people.
Headers, sender, links, and a search of every mailbox to find the true blast radius.
Read, unread, forwarded or filed. Reversible if it turns out to be legitimate.
| Role | Clicked | Now assigned |
|---|---|---|
| Substitutes | 5 | Spoofed principal |
| Business office | 3 | Bank-detail change |
| Coaches | 2 | Gift-card asks |
| Front office | 1 | Done |
Whoever clicks gets the thirty-second lesson for that exact scam. Students are never sent simulations.
What is included
A complete program, not a single tool.
Active threat manager
A live queue of everything your staff report, triaged and investigated by us, with a full audit trail.
District-wide remediation
Search every mailbox, quarantine or delete in one action, restore instantly if safe, block the sender going forward.
Phishing simulations
Realistic simulations of common lures such as payroll and tax-form requests, shared documents and sign-in pages. Scheduled and run for you, with results per person and per campaign.
Staff training library
41 short, plain-English lessons, most written for schools: student data, photos, gift-card and password scams. Each has a knowledge check, and completion is tracked.
Students are never phished
Simulations go to staff only. Student accounts are left out when your directory is synced.
Compliance and reporting
Training completion by staff member, trend reporting, highest-risk users, and board-ready PDF reports.
What you get to keep
Evidence your board and your insurer will accept.
Training records by name
Who completed what, when. Exportable for audits and insurance renewals.
Every action logged
Who did it, when, why, and how many inboxes were affected. Yours to keep.
Reporting for people who are not in IT
Risk down, reporting up, one page a month a superintendent can read.
Resources
Free guides for district technology teams
Short lessons, one-click reporting, no blame, and simulations timed to the school year.
Read it → ChecklistA staff member clicked a phishing link. Now what?The first hour, for the person who clicked and for the technology team.
Read it → PDFBlueHook overview for your boardSeven pages on what BlueHook does and what it costs to run. Hand it to a business officer or a board member.
Download →Questions districts ask
Before you call
Does it work with Google Workspace?
Yes. BlueHook works with both Microsoft 365 and Google Workspace. The report button sits in Outlook or Gmail.
What does my technology team have to do?
Authorize the connection once. After that, nothing is required for the loop to run. They see every alert and can act themselves if they prefer.
How fast is a real threat removed?
Illustratively, minutes from report to removal. Timings are relative, not a contractual commitment.
Can training be assigned to substitutes and new hires?
Yes. Shareable links make onboarding and substitutes simple, and completion is tracked per person.
Do you send phishing simulations to students?
No. Simulations go to staff only. Student accounts are left out when your directory is synced.
How often do simulations run?
Usually about once a month during the school year, avoiding testing weeks. We set the schedule with you.
Get started
Tell us what you are being asked to prove.
An insurance renewal, a state review, a board question. We will tell you which program answers it, or that none of them do. Straight answer, fixed quote, from the engineer who would do the work.
Reply within one business day. No sales sequence, no mailing list.