K-12 schools are adopting basic cybersecurity protections, but many remain unprepared to respond to a major incident, according to new research showing that just 15% of K-12 survey respondents regularly exercise incident response plans.
The Center for Internet Security (CIS), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Consortium for School Networking released the findings Oct. 27. Among surveyed schools and districts, 51% reported a cyber incident in the past year, and 34% reported incidents affecting school operations.
The State of K-12 Cybersecurity 2026 report combines MS-ISAC operational data from the 2025-2026 school year with a nationwide survey of 426 K-12 cybersecurity and technology practitioners conducted by CIS and MS-ISAC in August and September. Public school districts accounted for 91% of respondents’ organizations.
The survey shows a gap between preventive measures and response readiness. Eighty-three percent reported that they deployed multifactor authentication, and the same share used email filtering and phishing protection. However, just 59% maintained an incident response plan, and only 9% reported a fully implemented cybersecurity strategy.
“… when it comes to a major cyber event, I worry that most of us are not well prepared,” Michael Patton, superintendent of New York’s Saratoga Springs City School District, said in a press release.
Cyber incidents disrupted classroom instruction for 22% of respondents and student information or grading systems for 16%. Nine percent reported impacts to payroll or human resources systems.
Those risks fall to small teams. Two-thirds of respondents reported only one or two people responsible for cybersecurity, while 11% reported no dedicated cybersecurity personnel. Seventy percent reported delaying cybersecurity projects, technology investments, or staffing because of budget constraints.
Across the survey, 78% said their organizations would benefit from additional cybersecurity support, resources, or guidance.
“Schools are working hard every day to improve cybersecurity, often with small teams and very limited resources,” said Randy Rose, vice president of security operations and intelligence at CIS. “But the environment around them is changing quickly, especially as AI reshapes both the opportunities and risks for the K-12 community. The schools and districts that will be best positioned for the future are those that invest in the kind of cyber resilience that ensures a cyber incident doesn’t expand to a community-wide crisis.”
AI adoption outpaces policies
The research highlights a separate gap between artificial intelligence (AI) use and the policies governing it. Among respondents, 87% reported AI use by teachers and instructional staff, 81% by administrative staff, and 76% by IT or cybersecurity teams.
Only 33% reported formal AI policies, while 37% said policies were in development. Forty-two percent reported unofficial or ungoverned AI use.
Respondents’ leading AI concerns included AI-generated phishing attacks, cited by 69%, and the use of public AI tools with sensitive information, cited by 51%.
Phishing and compromised identities remain prominent threats beyond AI. In the survey, 87% identified phishing or email compromise as the most common incident type affecting their organizations, and 68% identified reducing human risk through awareness and phishing defense as a priority for the next 12 months.
Separate operational data illustrate the volume of activity reaching schools’ defenses. MS-ISAC escalated 11,638 incidents to K-12 organizations during the 2025-2026 school year, including 174 classified as critical. Its malicious domain blocking service blocked 3.52 billion requests to malicious or risky online destinations among participating K-12 organizations.
The report recommends that district leaders incorporate cyber incidents into continuity planning, emergency exercises, and crisis communications. It calls for policies covering AI use, data protection, acceptable use, and human oversight.
For state and local government leaders, the report recommends expanding schools’ access to shared monitoring, threat intelligence, incident response, and vulnerability management services, supported by recurring funding.
Technology and cybersecurity teams should conduct at least one tabletop exercise and one operational response exercise annually, according to the report. Both technical staff and school leadership should participate.
