K-12 Cyber Report Finds Staffing and Budget Gaps Create Security Needs

A new report from the Center for Internet Security (CIS), the Multi-State Information Sharing and Analysis Center (MS-ISAC) and the Consortium for School Networking (CoSN) documents persistent cybersecurity capacity gaps in U.S. K-12 schools and districts. The findings draw on responses from 426 K-12 technology and cybersecurity leaders surveyed in August and September 2026. The study considers incident experience, staffing and funding limitations, and the challenges of securing school systems as artificial intelligence tools are adopted faster than many organizations can establish policies and safeguards. For government contractors, the report is useful market context: it describes operational needs across a broad public-sector customer segment, but does not announce a procurement, award or dedicated funding opportunity.

Incident data underscores the potential consequences of those gaps. Among respondents whose schools or districts experienced a cyber incident in the prior year, 34% said it affected day-to-day school operations. The report identifies disruption risks not only to classroom instruction and networks but also to student information systems, communications, payroll and services relied on by families. Phishing and email compromise were among the leading incident types, cited by 87% of surveyed leaders. Attackers increasingly exploit credentials rather than relying only on technical vulnerabilities, and the report warns that artificial intelligence can make phishing messages and impersonation attempts more convincing.

The staffing and funding figures point to practical capacity constraints. Among incident-affected respondents, 66% said they had just one or two dedicated cybersecurity staff members; a separate report summary says 11% of surveyed organizations had no dedicated security staff. Nearly 80% said they needed additional cybersecurity support, resources or guidance, 56% described their programs as underfunded, and 70% said budget constraints delayed projects, technology investments or staffing. These conditions may make managed or shared monitoring, incident-response assistance and security services that reduce administrative workload relevant to school and state procurement teams. However, the report identifies no procurement vehicle, budget line or source of recurring funding, so vendors should not treat the findings as an active bid.

Credential compromise also creates a cross-district risk. MS-ISAC reportedly notified 808 of its 6,116 K-12 members during the last school year that staff accounts or credentials were circulating on underground or dark-web marketplaces. In the described “account takeover hopping” pattern, an attacker uses a compromised district account to send messages to its contacts, including staff at other districts, with legitimate accounts and authenticated email paths making the activity harder to filter. CIS assesses with high confidence that this pattern will continue this school year. Roy Park, Director of Cybersecurity & Digital Privacy at the San Joaquin County Office of Education, cautioned: “We know that a single compromised account is all it takes to advance toward a more lucrative target.” The report therefore supports market interest in identity protection and exposed-credential detection, while leaving purchasing decisions to individual districts and state or local procurement authorities.

• 70% of surveyed leaders said budget constraints delayed cybersecurity projects, investments or staffing; affordability and phased deployment may be important in future proposals.
• Nearly 80% reported needing additional cybersecurity support, resources or guidance, suggesting potential demand for managed services, shared services and technical assistance.
• Among organizations reporting an incident, 66% had only one or two dedicated cybersecurity staff; 11% of all surveyed organizations reportedly had no dedicated security staff.
• 87% identified phishing or email compromise as a leading incident type, creating a clear operational need for email security, identity controls, phishing defenses and staff awareness support.
• MS-ISAC identified 808 of 6,116 K-12 members with staff accounts or credentials found circulating on underground and dark-web marketplaces during the last school year; exposed-credential monitoring is a relevant capability area.
• The “account takeover hopping” pattern uses compromised legitimate accounts to target contacts in other districts, elevating the value of cross-organization threat sharing and rapid incident response.
• 34% of incident-affected respondents said an incident disrupted day-to-day school operations, with possible impacts to instruction, student systems, communications and payroll.
• The report describes AI adoption outpacing related policies and safeguards; contractors may find demand for practical AI-use policy development and security guidance, though no specific requirement or solicitation is announced.
• School and state procurement teams can use the findings to assess shared monitoring and recurring funding models; the report names no procurement vehicle or funding source, so vendors should treat it as market context rather than an active opportunity.