Safer Internet Day and the New Reality of Cyber Responsibility in Education

Cyber security has moved out of the server room and into the boardroom. No longer a technical issue handled quietly by IT teams, it is a shared responsibility, particularly for those in leadership roles.

With strengthened cyber security obligations now in place across Australia, cyber risk has become a governance and legal issue rather than just an operational one. Boards and executives are increasingly accountable for how cyber security is managed under the Cyber Security Act, marking a clear shift in expectations.

The change reflects a growing focus across the technology sector, including within Ingram Micro, on addressing cyber responsibility through coordinated partner ecosystems rather than isolated technical controls.

According to the Australian Cyber Security Centre's Annual Cyber Threat Report 2024–25, about 85,000 cyber incidents were reported in that timeframe. It can be an overwhelming thought to consider that cyber threats and scams are happening all around us. The upcoming Safer Internet Day is a global day of action dedicated to raising awareness of online safety. It offers a timely opportunity to step back and ask a critical question: Are our systems, people and partners truly prepared for today's cyber threats? 

What's unique about education environments?

Education environments are inherently complex, often shaped by a mix of diverse users, ageing systems, limited budgets and an increasing dependence on third-party platforms. These conditions create vulnerabilities that attackers actively look for and are quick to exploit.

The fact is, we now operate in a digital-first world where every one of us engages with cyber risk. Those risks can be relatively minor or incredibly serious and anyone can be targeted at any time. Often, it only takes one click, even from someone who knows the risks but briefly lets their guard down or has a moment of distraction. 

One of the most important lessons emerging from recent high-profile cyber incidents that have made headlines, is that many breaches do not originate within an organisation's own network. Instead, they come through third parties, such as software vendors, managed service providers, or cloud platforms that hold or access sensitive data.

For schools and early childhood education and care (ECEC) providers, third-party risk is often underestimated. Education leaders, especially those in the private sector, need to ask tough questions of their vendors. How is data protected? Where is it stored? What happens in the event of a breach? How quickly will leadership be notified?

Cyber resilience requires shared accountability. Contracts, procurement processes and vendor relationships must all reflect the reality that a partner's security arrangements can directly impact your own compliance and risk exposure.

What cyber resilience really looks like in education

Cyber resilience is often understood as having the right tools in place, be it firewalls, antivirus software or backup systems. While these are essential pieces of the puzzle, true resilience goes much deeper.

In a real-world school setting for example, cyber resilience is about the ability to continue operating, recover quickly and protect people when something goes wrong. It's not necessarily about preventing every incident, but about preparedness, response and recovery.

For education environments, this includes secure identity and access management for staff and students, regular patching and system updates, reliable backup and recovery plans and clear incident response procedures that are understood beyond the IT team.

The most common ways attackers get in

Despite the sophistication of modern cyber-attacks, many breaches still begin in surprisingly simple ways. Unpatched systems, weak passwords and phishing emails are among the most common entry points for attackers.

Phishing continues to be one of the biggest risks. All it takes is one convincing email and a single click. Attackers know how to exploit tired or busy staff, casual employees and even students.

The rise of remote learning, cloud-based collaboration tools and personal devices has expanded the attack surface significantly. Without consistent security controls and user awareness, these tools can become easy targets. It only takes one neglected device, like an old PC running Windows 10 (which is no longer supported), to expose an entire network.

Regular system updates, multi-factor authentication and ongoing staff education are foundational controls that significantly reduce risk when implemented effectively.

A people-first approach 

A proactive, people-first approach to cyber security is critical. That means building a culture where staff feel empowered to report suspicious activity, where cyber awareness is part of professional development and where leadership prioritises digital safety.

True resilience combines training, automation and independent validation. Technology offers speed and coverage, but people provide context and judgment. Security improves when systems make the safe choice the easy one.

This balance reflects a broader shift across the technology sector, including in Ingram Micro's work with education partners, towards treating cyber responsibility as a question of governance, capability and shared accountability rather than technology alone.

Safer Internet Day serves as a timely reminder that cyber safety is a shared responsibility. For Australian schools and ECEC providers, cyber resilience is not just a compliance exercise. It is a leadership commitment to protecting trust, enabling continuity and supporting safe, connected learning.