Securing K-12 Education Providers
Against Advanced Cyberthreats
Sophos MDR is the leading Managed Detection and Response service for theK-12 sector
K-12 education providers are a prime target for cybercriminals. Adversaries are increasingly attracted by the valuable
and sensitive information these organizations hold, their broad attack surface, and the opportunity to extort payments
using ransomware and the threat of breach exposure.
As cyberthreats grow in both volume and complexity, many K-12 providers are turning to the Sophos ManagedDetection and Response (MDR) service for protection against advanced attacks that technology alone cannot prevent.
This solution brief explores the cybersecurity challenges facing the sector and introduces Sophos MDR, the numberone MDR service supporting K-12 education today.

A Sophos Whitepaper. February 2023

Securing K-12 Education Providers Against Advanced Cyberthreats

The Cybersecurity Challenge Facing K-12
K-12 education is a major target for cyberthreats
Over half (56%) of K-12 providers were hit by ransomware in 2021. In comparison,across the education sector as a whole, 44% of organizations fell victim to anattack in 20201. This 27% rise over the course of a year demonstrates the rapid
acceleration of the cyberthreat challenge facing the education sector.
More broadly, a considerable proportion of IT managers working in K-12 education
reported an increase in the volume (47%), perceived complexity (44%) and impact(38%) of cyberattacks over the last year. As cyber criminals continue to leverage
automation and the ‘malware-as-a-service’ model in their attacks, these numbers
are only set to increase.

The impact of advanced cyberthreats on K-12 education issevere
A major cyber incident has very considerable financial and operational repercussions
for K-12 providers. In 2021, the average cost to the sector to remediate a
ransomware attack came in at $1.58 million, with well over one third (39%) of theencrypted data remaining unrecovered after the incident.
Recovery costs are just part of the story. Nearly all (94%) K-12 providers hit byransomware said the attack impacted their ability to operate, while 92% of those in
the private sector said it caused them to lose business/revenue. In both cases, these
are amongst the highest impact figures reported across all industry sectors. If IT
systems go down, providers’ ability to deliver teaching and learning is often severely
inhibited, with major repercussions for students and staff.
Recovery can be time-consuming, with nearly a quarter (21%) of K-12 education
ransomware victims taking over a month to get back to normal after the attack.

56% hit by ransomware in 2021
47% report an increase in attack volume
44% report an increase in attack complexity
38% report an increase in the impact of cyberattacks

US$1.58M

ransomware recovery cost

94%of attacks impacted ability to operate

92%of attacks resulted in lost business/revenue (private sector only)

1 The State of Ransomware in Education, 2022, Sophos. Independent survey of 5,600 IT professionals including 320 from
K-12 education providers. Hit by ransomware is defined as one or more devices being impacted but not necessarily
encrypted.

A Sophos Whitepaper. February 2023

Securing K-12 Education Providers Against Advanced Cyberthreats

K-12 education providers are struggling to keep pace with wellfunded adversaries
The reality is that technology solutions alone cannot prevent every cyberattack. Toavoid detection by cybersecurity solutions, malicious actors increasingly use legitimate
IT tools, exploit stolen credentials and access permissions, and leverage unpatchedvulnerabilities in their attacks. By emulating authorized users and taking advantage
of weaknesses in an organization’s defenses, malicious actors can avoid triggering
automated detection technologies.
The only way to reliably detect and neutralize determined cyber attackers is with 24x7
eyes on glass delivered by expert operators who leverage diverse security alerts and realtime threat intelligence to identify and stop threats before the damage is done.
However, the complexity of modern operating environments and the velocity ofcyberthreats make it increasingly difficult for most organizations to successfully manage
threat detection and response on their own. Illustrating this point, the average intruder
dwell time in the education sector was 34 days, more than double the 15-day crosssector average2.
Organizations across all sectors, including K-12 education, are struggling to keep pacewith well-funded adversaries who are continuously innovating and industrializing theirability to evade defensive technologies.

2 The Active Adversary Playbook 2022, Sophos - Report is based on 144 incidents targeting organizations of all sizes in a wide rangeof industry sectors

A Sophos Whitepaper. February 2023

Securing K-12 Education Providers Against Advanced Cyberthreats

Sophos MDR:
Securing K-12 Education Providers
As the cybersecurity challenge continues to grow, K-12 education providers
are increasingly turning to the Sophos MDR service to help them stay ahead oftoday’s advanced threats.

24/7/365 ransomware and breach prevention service
Sophos Managed Detection and Response (MDR) is a fully managed service
delivered by experts who detect and respond to cyberattacks targeting yourcomputers, servers, networks, cloud workloads, email accounts, and more.
Ì Detect: We monitor your environment 24/7, collecting, contextualizing, andcorrelating security data from the Sophos Adaptive Cybersecurity Ecosystemand your existing cybersecurity investments to identify suspicious activities
Ì Investigate: Expert human operators investigate potential
incidents, leveraging our deep K-12 education sector andthreat expertise to hunt for signs of adversarial activities
Ì Remediate: Analysts quickly remediate attacks across the broad
range of your environment, before they turn into something moredamaging such as ransomware or a wide scale data breachÌ Review: Comprehensive root cause analysis of incidents together
with regular health checks and weekly and monthly reporting enable
you to improve security posture and prevent future recurrenceWith an average time to detect, investigate and remediate of just 38 minutes,
Sophos MDR is more than 5 times quicker than even the fastest in-house security
operations team.
With Sophos MDR, you benefit from our team of over 500 security operations
specialists who provide expertise across all elements of the detection andresponse cycle, from threat hunting and neutralization to malware engineeringand security automation. With six security operations centers (SOCs) locatedacross Australia, India, Europe, and North America, we provide seamless 24/7
coverage every day of the year.

A Sophos Whitepaper. February 2023

A service designed around you
We understand that each K-12 establishment is different with their own existing
security investments, IT/cybersecurity staff, and IT environment. Sophos MDR meets
you where you are: you choose the level of support required, whether you want us
to notify you of threats so your team can take remedial action, contain threats on
your behalf, or provide full incident response and root cause analysis. Our security
specialists will work with you to identify the right approach for your organization.

Elevate your protection using your existing investments
Today’s advanced threats can come from any direction. Sophos MDR analysts detect
and respond to attacks across your entire environment using the Sophos and thirdparty security tools you already have in place. We can use your:Ì Endpoint telemetry to spot malicious activities and attack behaviors
Ì Firewall data to detect intrusion attempts and beaconingÌ Network telemetry to identify rogue/unprotected devices, and novel attacks
Ì Email alerts to pinpoint network entry and attempts to steal access data
Ì Identity data to detect unauthorized entry and attempts to escalate privilegesÌ Cloud alerts to indicate unauthorized network access and efforts to steal data
The more we see, the faster we act. By detecting and responding to advanced
attacks using your existing security tools, Sophos MDR reduces cyber risk while
increasing return on your security investments.

Securing K-12 Education Providers Against Advanced Cyberthreats

Sophos MDR: The Number One MDR Service
For K-12 Education Providers

Hear from our education customers

Sophos is the number one MDR provider globally, securing more organizations
than any other provider against ransomware, breaches, and other threats thattechnology alone cannot stop.

"The MDR team disabled the threat, reported thefindings to us, and included the username, workstation
ID, and the type of drive used. I was able to inform theemployee of the problem so it did not happen again.
Overall, we are very pleased with their services."

Sophos MDR secures many hundreds of education organizations, giving us
unparalleled depth and breadth of expertise into threats facing K-12 proviers. We
leverage this extensive telemetry to generate ‘community immunity’, applying
learnings from defending one provider to all other customers in the sector,elevating everyone’s defenses.
Of course, what matters most is the cybersecurity outcomes we deliver for ourcustomers. Sophos is the highest rated and most reviewed MDR solution onGartner® Peer Insights™ with a 4.8/5 rating across 271 reviews as on December
20th, 2022 and 97% of customers saying they would recommend us. Sophos
is also rated the Top Vendor in the 2022 G2 Grid® for MDR Services serving themidmarket, as well as being named a Leader for MDR in the G2 Overall, Midmarket
and Enterprise segments.

Number 1 for K-12 Education✓Most trusted:over 15,000 organizations use Sophos MDR✓

Highest rated:
97% of customers would recommend us✓

Most reviewed:
271 reviews on Gartner Peer Insights in 2022

A Sophos Whitepaper. February 2023

<5000 Employees, North America. Full review on Gartner Peer Insights"Sophos Is a valued security partner with the college."<5000 Employees, North America. Full review on Gartner Peer Insights“Sophos Works and makes things easy. TheMDR team has always been communicative,
helpful, and given great support.”<5000 Employees, North America. Full review on Gartner Peer Insights

Securing K-12 Education Providers Against Advanced Cyberthreats

Next Steps
To learn more about Sophos MDR and how we cansupport your organization, speak with a Sophos
adviser today or visit www.sophos.com/mdr“The Sophos team acts as our goalkeepers,
sitting behind us with their skill sets and giving
us reassurance that they have our back.”
Inspire Education GroupSophos MDR
Ì 24/7 real-time threat monitoring and responseÌ Expert lead threat hunting
Ì Cross-product (Sophos and third-party) consolidation and correlationof security event dataÌ Full-scale managed incident response (unlimited number of hours;
no additional fees or retainers)
Ì Best in class breach protection warranty
Ì Dedicated incident response lead assigned
Ì Direct call-in support to Sophos security operations centers(6 global SOCs)
Ì Weekly and monthly activity reports
Ì Monthly intelligence briefings
Ì Root cause analysis performed to improve security posture and prevent
recurrence of future threatsÌ Regular Sophos account health checks to review configurations andensure optimal performance

Gartner does not endorse any vendor, product or service depicted in its research publications and does notadvise technology users to select only those vendors with the highest ratings or other designation. Gartner
research publications consist of the opinions of Gartner’s Research & Advisory organization and should not
be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect tothis research, including any warranties of merchantability or fitness for a particular purpose.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. andinternationally, MAGIC QUADRANT and PEER INSIGHTS are registered trademarks of Gartner, Inc. and/or its
affiliates and are used herein with permission. All rights reserved.

© Copyright 2023. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2023-02-20 (WP-NP)

Gartner Peer Insights content consists of the opinions of individual end users based on their own
experiences with the vendors listed on the platform, should not be construed as statements of fact, nor dothey represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service
depicted in this content nor makes any warranties, expressed or implied, with respect to this content,
about its accuracy or completeness, including any warranties of merchantability or fitness for a particularpurpose.