Student Cybersecurity Training: A K-12 Guide for Schools

Why Schools Train Students Now

Students have become a target. School IT teams tell us about phishing and business email compromise (BEC) aimed at students, and about student accounts that were compromised and then used to phish other students and staff. That's the most common reason schools add student training.

The U.S. Department of Education names phishing email one of two critical weaknesses that attackers exploit in K-12, and lists spotting and reporting it among its relatively low-cost steps. In Sophos's 2025 survey, phishing was the top-reported root cause of ransomware attacks on K-12 schools, used in 22% of incidents.

Some states also require this teaching. The U.S. Department of Education calls North Dakota the first state to require K-12 cybersecurity education. Check what your own state asks for.

Start With Student Email Access

It helps to know which students can get mail from outside the school. If outside mail can't reach a student's inbox, real phishing from outside can't either, so those students face less risk.

In Google Workspace, people can email any address by default. Google's own help page uses a school as its example, letting students exchange messages "with faculty, staff, and other students, but not with people outside of the school". The setting is called Restrict delivery. You set it per organizational unit, so each student unit can differ from staff. To check it, go to Apps, Google Workspace, Gmail, and Compliance in the Admin console, and open each student unit.

Microsoft 365 has a similar option. An admin can set a mail flow rule that matches a group's members and rejects mail to or from outside the organization.

In many districts, elementary students have no email at all, middle school email is internal only, and only high school students can send and receive email outside the domain. Others keep student email on a safelist, so only approved domains get through.

These settings don't stop Tartan's practice emails, which are delivered straight into Google Workspace and Microsoft 365 inboxes. You choose which students to include.

Student Training for Every Grade

Tartan's Student Phishing & Video Training is available for every grade, K-12, and runs separately from staff training:

• Video training for every student.
• Practice phishing emails for the students you choose.
• Short training after a click, so a student sees the red flags they missed right away.

Many schools already teach digital citizenship. Tartan's student videos fit alongside those lessons, from elementary through high school.

Additional Digital Citizenship Resources

If teachers want lessons to go with Tartan's training, these free curricula cover K-12:

• Common Sense Media's Digital Literacy & Well-Being curriculum has more than 165 lessons, including one on phishing called "Gone Phishing."
• CYBER.ORG lists free cyber lessons and courses for K-12 settings, plus short videos for students.

Rolling Out Student Training

Most schools start with staff and add students later, as a separate group with its own campaigns. Some districts take student training to their board first.

Rush-Henrietta Central School District in New York added students in grades 9-12 to its phishing simulation campaign in October 2025. The district's reason: student email "may be used for out-of-district communication". Its goal is to help students identify, avoid, and report suspicious emails "without fear of penalty."

Plan Your Launch

• Pick a good week, such as Digital Citizenship Week or a start-of-term orientation. Avoid holidays, homecoming, and exams.
• Train first, so students know what a practice email is before the first one arrives. Start with a short video like Before You Click: Pause and Verify.
• Use emails students recognize, like Google Classroom, Microsoft 365, or apps they use, not payroll or invoice emails meant for staff.
• Give students a lighter schedule. Student campaigns run on their own schedule, separate from staff.

Our Guide to Phishing Simulation for Schools covers setup, delivery, and metrics in more detail.

Make It a Game for Students

Points give students a reason to watch the videos and report practice emails. In Tartan, students can earn points for both, and the leaderboard groups students separately from teachers and school staff. When you share the leaderboard, you choose whether it includes students.

One international school launched student training during Digital Citizenship Week. High school students watched a couple of videos and got practice phishing emails that week, earning points for both, with prizes.

• Prizes schools use: stickers, candy, school T-shirts, and raffles.
• Some schools hold a monthly draw for everyone who reported a practice email.
• Rank students against each other, not against staff, and keep younger and older students apart.

Measuring Student Results

Students may click less than staff, partly because many teenagers don't use email the way staff do. Look at reports and video completion as well as clicks, and compare results by school.

Student Data Privacy

Practice emails and training create data about students, such as who clicked and who finished a video. Before you add students, ask whether the vendor will sign your state's student data privacy agreement. Tartan has signed the Student Data Privacy Consortium's National Data Privacy Agreement. Our privacy policy addresses FERPA and COPPA, and fake login page tests store nothing a person types.

The FTC's COPPA Rule protects children under 13. A school can consent for parents when a vendor collects student data for the school's use. That consent covers the educational context only. The vendor may not use the data for any other commercial purpose, and it must give the school the same notice about its data practices that it would give a parent.

Before you sign with any vendor, ask three questions:

• Will you sign our state's student data privacy agreement?
• What student data do you collect during simulations and training?
• Do you use that data for anything beyond our school's training?

Student Cybersecurity Training Cost per School and per Student

Many schools expect to pay per student. Tartan's Student Phishing & Video Training is its own product, separate from staff training. Public districts pay per school: $270 a year for a district with one school, covering every student there. The price per school drops a little as the count grows. 10 schools pay $2,665 a year.

Independent, charter, and ESA schools pay by student count instead. Tiers run from 500 to 4,600 students, and larger schools get custom pricing. An independent school with 500 students pays $270 a year, about 54 cents a student.

See Tartan Pricing for 1 to 10 Schools. Comparing vendors for staff and students? Our guide to the Best Security Awareness Training for Schools covers both.