.png){kind=small}
Education
Keep learning, research and student data safe.
ThreatGaurd helps schools, universities, research institutions and EdTech providers protect student and staff data, keep teaching and exams running, and show parents, partners and regulators that security is taken seriously.
Why it matters
Open by design, and that is exactly what attackers like.
Education depends on openness: thousands of users, personal devices, shared labs and collaboration with partners around the world. That same openness gives attackers more ways in, from stolen passwords to unpatched systems.
Most institutions also work with small IT teams and tight budgets. Security has to focus on the few things that reduce the most risk, and fit around the academic year.
-
Thousands of users, changing every year
Students and staff join and leave constantly, and old accounts are easy to forget.
-
Open networks and personal devices
Campus Wi-Fi, shared labs and personal devices make it hard to separate users from critical systems.
-
Valuable data, limited resources
Student records, research and finance data are often protected by small, stretched teams.
A plan for the whole year
A security plan that follows the academic year.
Every institution runs on a calendar. We schedule security work around yours, so the right systems get attention at the right time and teaching is never disrupted.
-
Before admissions open
Admissions and fees
Application portals and fee payment systems face their heaviest use.
- Test admissions and payment portals
- Check access to applicant documents
- Review payment integrations
-
Start of term
Identity and access
Thousands of new accounts are created, and old ones should be removed.
- MFA for staff and administrators
- Remove accounts of people who have left
- Review privileged and shared accounts
-
Exam and results season
Exams and results
Exam, grading and results systems must stay available and tamper-proof.
- Protect exam papers and results data
- Limit admin access to grading systems
- Freeze changes to critical systems
-
Term breaks
Deeper testing and recovery
Quieter periods are the best time for intrusive testing and recovery drills.
- Internal network and Active Directory testing
- Harden servers and lab machines
- Test backup restores and recovery plans
Term dates vary by country and institution, so we plan around your actual calendar.
Who we work with
From classrooms to research labs.
Schools, universities, research teams and EdTech companies face very different risks. Choose yours to see where we usually focus.
Schools and school groups
Schools hold sensitive data about children and families, often with small IT teams, shared devices and systems run by outside providers.
Security priorities
- Protection of children’s and parents’ data
- Secure student devices and shared computers
- Strong admin access and tested backups
- Simple policies staff can actually follow
Colleges and universities
Universities run open networks for thousands of students, staff and visitors, alongside admissions, finance, exam and research systems.
Security priorities
- Open campus networks separated from core systems
- MFA and identity for students and staff
- Secure admissions, fees and exam portals
- Visibility of vulnerabilities across departments
Where we usually start
Research institutions
Research teams work with valuable intellectual property, sensitive datasets and collaborators around the world, often in cloud and high-performance computing environments.
Security priorities
- Protection of research data and intellectual property
- Secure access for external collaborators
- Funder and sponsor security requirements
- Secure research cloud environments
Where we usually start
EdTech platforms
EdTech companies process student data on behalf of schools and universities, who increasingly expect proof of security and privacy before they sign.
Security priorities
- Secure APIs and separation between customers
- Privacy by design for children’s data
- Evidence for school and university procurement
- Secure cloud and release pipelines
Where we usually start
Why ThreatGaurd
Security work that respects students and teaching.
-
Planned around your calendar
No intrusive testing during admissions, exams or results periods, unless you ask for it.
-
Student data stays protected
Test accounts instead of real student accounts, and no copying of student records.
-
Right-sized for your team
Practical, prioritised fixes that small IT teams can actually deliver.
-
Clear reporting for leadership
Plain-language summaries for principals, registrars, boards and governors.
Before any testing starts
- Signed NDA and written authorisation
- Dates agreed outside exams and admissions
- Test accounts approved by your IT team
- Named contacts and an escalation path
Nothing is tested until scope, timing and contacts are confirmed in writing.
How we handle your dataRegulations and frameworks
Aligned to the rules that protect students and research.
Requirements depend on where you operate and who you serve. We map our work to the ones that apply to you.
-
Personal data
Privacy and student data
- India DPDP Act and Rules
- EU and UK GDPR
- US FERPA and COPPA
-
Security standards
Security frameworks
- ISO/IEC 27001:2022
- NIST Cybersecurity Framework 2.0
- CIS Controls v8
-
Sector guidance
Education and research
- UK DfE cyber security standards
- UK Cyber Essentials
- NIST SP 800-171 for research data
ThreatGaurd provides security testing, readiness and privacy advisory services. Certifications are issued by accredited bodies, and legal interpretation should be confirmed by your legal counsel.
FAQ
Questions education leaders ask us
Can’t find your answer? Our team is happy to help.
Can you test without accessing real student data?
Yes. We use dedicated test accounts wherever possible, avoid copying or downloading student records and show only the minimum evidence needed to prove a finding.
When is the best time to test?
Term breaks are usually best for deeper testing and recovery drills. Lighter, non-intrusive work can run during term, and we avoid admissions, exam and results periods unless you ask otherwise.
How does the DPDP Act affect schools and EdTech companies?
The DPDP Act and its Rules, notified in November 2025, set obligations for handling personal data, including extra protection for children’s data, with most obligations phasing in over 18 months. We help you map your data, update notices and consent, and secure the systems that hold it. Legal interpretation should be confirmed by your counsel.
We have a small IT team. Where should we start?
Usually with identity and backups: MFA for staff and administrators, removing old accounts and making sure backups can actually be restored. A short gap assessment then shows which steps reduce the most risk for your budget.
Can you help an EdTech company pass school or university security reviews?
Yes. We help with API and application testing, privacy reviews and ISO 27001 or SOC 2 readiness, so you have clear evidence for security questionnaires and procurement.
Do you work with institutions outside India?
Yes. Each engagement is scoped to the regulations and frameworks that apply where you operate, such as GDPR in Europe, FERPA in the United States or the DfE standards in England.
Get started
Talk to us about protecting your institution.
Tell us about your institution, your systems and your academic calendar. We will recommend a practical plan that fits your team and budget, with no obligation.
What happens next
- A short scoping callWe learn about your systems, team and calendar.
- A fixed-scope proposalClear scope, timing and cost, planned around your term dates.
- Work at the right timeActivities run in agreed windows, with regular updates.