Phishing training for school staff that actually works
Most incidents in a school district start with an email to a person, not a flaw in a server. Here is how districts run phishing training that staff do not resent, and that holds up when an insurer or a board asks for proof.
Why school staff are the target
In the Center for Internet Security’s 2025 K-12 Cybersecurity Report, 82% of K-12 schools reported a cyber incident between July 2023 and December 2024: more than 9,300 confirmed incidents across an estimated 5,000 institutions. The report points to phishing and social engineering, with attackers tricking staff into giving up sign-in details by posing as trusted officials.1
Schools are easy to target for reasons that have nothing to do with carelessness: a culture of helping, staff who are interrupted all day, and a public website that lists who works where. Training cannot change any of that. Its job is to make the right reaction automatic: pause, then report.
Five habits of programs that work
1. Keep lessons short and specific
A few minutes at a time beats an hour-long course once a year. Lessons should be about the situations staff actually meet: student data, photos of students, requests to buy or pay for something, and sign-in pages that are not what they seem.
2. Make reporting the goal
A report is worth more than a non-click. One report lets the technology team find and remove the same message from every other inbox before anyone else falls for it. Put a report button in Outlook and Gmail, and thank every person who uses it.
3. Never punish a click
Staff who fear getting in trouble stop reporting, and the click nobody reports is the dangerous one. A click in a simulation should lead to a short lesson about that exact trick, and nothing more.
4. Work with the school calendar
Avoid testing windows, the first week back and the last days before a break. Remind everyone before long breaks, when fewer people are watching email and a problem can sit unnoticed for days.
5. Include everyone with a district email address
Substitutes, coaches, transportation and cafeteria staff, board members: anyone with an inbox can be the way in. New hires and substitutes should get training in their first week, not at the next annual session.
Simulations are for staff, never students
Simulated phishing emails are for adults. Students should learn digital safety in class, not receive fake scams. BlueHook sends simulations to staff only, and student accounts are left out when the district directory is synced.
Measure what matters
- Report rate. The share of staff who report a simulation. This is the number to grow.
- Time to first report. How quickly the first person reports it, because removal for everyone starts there.
- Click rate. Worth tracking, but not the headline. It moves with how hard the simulation was.
- Training completion by name. Who finished what, and when. This is what auditors and insurers ask for.
What insurers and boards will ask for
Cyber insurance applications commonly ask whether staff receive security awareness training and phishing simulations, and how often. Keep completion records by person and date, simulation results by campaign, and a written procedure for what happens when someone reports or clicks. Our response checklist is a starting point for that procedure, and the compliance page covers the rules that apply to districts.
How BlueHook runs this for you
- Simulations scheduled and run for you, with results per person and per campaign.
- A library of 41 short staff lessons, each with a quick knowledge check, assigned automatically after a click.
- A report button in Outlook and Gmail. Every report is investigated by an analyst.
- A real threat removed from every inbox in the district in one action, and reversible if it turns out to be safe.
- Training records and a one-page monthly report a superintendent can read.
Questions
Common questions
How often should a district run phishing simulations?
We suggest about once a month while school is in session, skipping testing weeks. Short, regular exercises do more than one big test a year.
Should staff know that simulations are happening?
Yes. Tell staff the program exists and why, but not when a simulation will arrive. Most people take it well once they know the goal is reporting, not catching anyone out.
Do you send simulations to students?
No. Simulations go to staff only. Student accounts are left out of simulation lists.
What happens when someone clicks a simulation?
They see what gave the email away and get a short lesson on that exact trick. Results go to your technology team. We recommend not publishing names.
Get started
Tell us what you are being asked to prove.
An insurance renewal, a state review, a board question. We will tell you which program answers it, or that none of them do. Straight answer, fixed quote, from the engineer who would do the work.
Reply within one business day. No sales sequence, no mailing list.