K-12 staff training guide
Cybersecurity Training for Schools: What Staff Click and What Free Training Covers
By Shea Darlison, Co-Founder
In Tartan App's phishing simulations at schools, the most-clicked emails look like school paperwork and apps: a tax form, the tech handbook, a Google Classroom comment. So train staff on emails like these, all year. A free course covers the basics. Your school supplies the practice and a one-click way to report.
It's worth the effort. Among schools hit by ransomware in Sophos's 2026 survey, malicious email was the most common technical root cause, at 31%.
- Simulations clicked
- 9.9%
- Of 244,473 sent through Tartan App
- Fake tax form
- 34.2%
- Clicked, of 407 sends
- First staff report
- 38.8 min
- Median, real reported emails at 150 schools
Free and Low-Cost Cybersecurity Training for K-12 School Staff
Start with what's free. Two sources are worth your time.
- CISA guidance: the Cybersecurity and Infrastructure Security Agency's 2023 K-12 report names five first investments. A strong cybersecurity training program is one. The others are multi-factor authentication, mitigating known exploited vulnerabilities, tested backups, and a regularly exercised incident response plan.
- Fortinet: its Security Awareness and Training Service is free for U.S. K-12 school districts. It includes training modules, quizzes, short videos, awareness materials, and completion certificates. Phishing simulations come with Fortinet's paid version.
CISA's report also asks the question every program has to answer: "When people on the front lines see something suspicious, do they know how to report it?" A course can tell staff the answer. They only learn it by doing it: practicing on realistic emails and using a report button.
For public schools and school boards, Tartan App is priced per school with unlimited staff. For a district with one school, Employee Video Training is $30 a year. Employee Phishing Simulation Training is $116, and the Phish Report Button, Threat Manager & Gamification is $45. See Tartan's pricing or what security awareness training costs across vendors.
Texas Certified Cybersecurity Training for Schools
Texas Cyber Command (TXCC) certified 86 cybersecurity training programs for fiscal year 2027, valid until August 31, 2027. You can filter the list for K-12 school districts. In a Texas school district, only the cybersecurity coordinator must complete certified training each year. The district sets the schedule for other staff. Tartan App's training program is TXCC-certified for 2026–2027.
Cybersecurity Training for Students
Tartan's Student Phishing & Video Training is sold separately from staff training. It's designed mainly for middle and high school students, and that's who most schools buy it for.
For classroom lessons, two free sources help. CYBER.ORG offers its curriculum and virtual professional development at no cost to U.S. K-12 educators, and it is supported in part by CISA. Common Sense Education publishes cybersecurity lessons for grades K-12.
Phishing Training for Teachers and School Staff: What Gets Clicked
Schools have sent 244,473 phishing simulations through Tartan App, and 24,287 were clicked. That's a 9.9% click rate. The median school's rate was 10.1%. Some emails get clicked far more often than one in ten.
The top eight fall into three groups. Forms: Tax Form Incomplete (34.2% of 407 sends), Address Confirmation (31.2% of 375), and Staff Survey (25.5% of 643). School policy: Tech Handbook Review (28.1% of 791) and Policy Update (22.8% of 615). Notices from everyday apps: a Google Classroom comment (26.5% of 1,304), a shared Google Sheet (23.9% of 4,561), and a DocuSign comment (23.6% of 5,157).
None of these is unusual. School software gets clicked too: next on the list is a Skyward Finance notice to accept updated terms, at 22.5% of 386 sends.
So train on emails like these. In a staff meeting, show a fake tax form or Classroom notice and ask what gave it away. Then keep the practice going. A field study of 409 public-sector employees in Germany found better phishing recognition held four months after training and faded by six. The authors recommend a reminder every half year.
Tartan runs simulations on an automatic 15, 30, 60, or 90-day cycle. Each person gets one email per cycle, at a random time, from 110+ templates. Training videos are short and end in a quick quiz. Staff open them from a link, with no account or password. For setup steps, see how to run phishing simulations in a school.
How School Staff Report Suspicious Emails
Tartan App Shield adds a report button to Gmail and Outlook. Since June 2026, 3,611 staff at 150 schools have used it to report 7,393 real emails.
- The first report came a median 38.8 minutes after the email arrived.
- Of the reported emails Tartan's AI rated, 29.7% were malicious and 20.2% were suspicious.
- Google was the brand impersonated most, in 700 reported emails at 110 schools. Microsoft came next, with 140 at 52 schools.
One early report is a warning for everyone else. Tartan can move a reported email to spam in every mailbox at once. The person who reported it gets an email back saying whether it was safe or a threat, and what IT did about it. See Tartan's platform, or how it compares in the best security awareness training for schools.
School Cybersecurity Training FAQ
Does the FCC Cybersecurity Pilot Program Pay for Staff Training?
No. The FCC's list of eligible services says training is ineligible, along with security cameras, insurance costs, and threat response exercises. The one exception is basic instruction on equipment the pilot pays for, when it's part of that equipment's contract.
Do Cyber Insurance Applications Ask About Phishing Training?
Typical applications do. Indiana's cyber insurance toolkit lists sample application questions, including "Does the Applicant conduct email phishing simulations?" Our phishing simulation guide covers the other questions schools get.
Pricing
How Is Tartan App Priced?
Prices are in US or Canadian dollars, on a 1-year term. A 3-year term saves 5%, and a 5-year term saves 10%. Onboarding is free, and most schools are set up in under 30 minutes.