Today's Microsoft 365 outage has provided an uncomfortable reminder of just how dependent schools have become on a relatively small number of technology providers.
The disruption, which began yesterday, has affected Microsoft services including Outlook, Exchange Online, Teams and Copilot, alongside elements of the administration and security tools that organisations rely on to manage their environments. Microsoft has been working to restore services, with reports of intermittent recovery and continuing disruption across different regions.
At the time of writing, there is no evidence that the outage was caused by a cyberattack. That distinction is important. However, I think the operational consequences provide a valuable opportunity for schools to consider a much more difficult question.
What would happen if the same disruption were caused by a cyberattack against your school, and you had no indication of when your systems could be restored?
For many schools, Microsoft 365 is no longer simply an email and productivity platform. It has become part of the infrastructure supporting teaching, learning, administration, communication and school operations. Staff depend on Outlook for communication with colleagues and parents. Teams supports collaboration and meetings. SharePoint and OneDrive provide access to documents and operational records. Microsoft Entra ID supports identity and access management across other systems. Increasingly, Copilot and other AI functionality are becoming integrated into these everyday activities.
It’s Microsoft’s vision that a school’s usage of their platform grows through all school systems connecting into the Microsoft tenancy via a product called Fabric, with schools relying on Co-Pilot as the means of access, retrieval and interrogation of those systems.
When parts of this environment become unavailable, the consequences can extend well beyond the inconvenience of not being able to send an email.
A major technology outage and a cybersecurity incident are not the same thing. But they can create many of the same operational challenges.
The difference is that, following a successful cyberattack, schools may also be dealing with compromised accounts, stolen information, malicious activity across their network, uncertainty about which systems can be trusted and the possibility of an extended recovery period.
They may need to isolate systems, suspend access, investigate the extent of a compromise, assess personal data breaches and coordinate communications with staff, parents, regulators and other stakeholders.
The operational disruption becomes part of a much wider incident.
In our work with schools around the world, we are increasingly concerned about the way AI is changing the capabilities available to cybercriminals. My expectation is that the velocity of AI-enabled cyberattacks will increase significantly, and that many schools are not sufficiently prepared for the consequences.
This is not because AI has suddenly invented an entirely new category of cyber threat. Many of the techniques remain familiar: phishing, credential theft, account compromise, exploitation of vulnerabilities, social engineering and ransomware.
What AI changes is the speed, scale and sophistication with which those techniques can be deployed.
Consider phishing. Historically, many attacks were relatively easy to identify because of poor grammar, generic messaging or obvious inconsistencies. Generative AI can now produce convincing communications, adapt them to different audiences and incorporate publicly available information about the people being targeted.
A cybercriminal can research a school's leadership team, identify the business manager, understand the organisational structure and create a credible message appearing to come from the Head requesting an urgent financial transaction.
That attack can be supported by AI-generated audio or video impersonation. Consumer-grade technology already makes it possible to imitate a person's voice or create convincing visual representations.
We are also concerned about how AI can assist attackers in identifying weaknesses, writing or adapting malicious code, automating reconnaissance and coordinating elements of an attack that previously required more specialist knowledge or manual effort.
Not every AI-assisted attack will succeed, and AI does not remove the technical barriers to sophisticated intrusion. But it can reduce the time and cost of preparing attacks, allowing criminals to target more organisations and adjust their approach more quickly.
That matters particularly for schools.
The challenge is not that schools have ignored cybersecurity. Many have invested substantially in firewalls, endpoint protection, cloud services, multifactor authentication and staff awareness.
The problem is that the effectiveness of those investments is not always independently tested, and operational resilience is not always considered alongside technical security.
There are several recurring issues we encounter.
First, schools often have limited internal cybersecurity capacity. A Director of Technology may be responsible for infrastructure, classroom technology, helpdesk services, strategic projects, procurement and cybersecurity. Even with a capable team, there is a limit to how much specialist testing, monitoring and incident preparation can be undertaken.
Second, many schools operate complex technology environments that have developed over several years. Legacy systems, cloud services, third-party applications, devices and integrations can create weaknesses that are not immediately visible. A school may have implemented appropriate security products without fully understanding whether its configuration and access controls are effective.
Third, there is a tendency to equate having cybersecurity controls with knowing those controls will work. A backup policy does not demonstrate that systems can be restored within an acceptable timeframe. Multifactor authentication does not automatically address every identity-related risk. A penetration test completed several years ago does not establish the security of today's environment.
Fourth, cybersecurity is sometimes treated primarily as an IT responsibility rather than an operational and leadership risk.
This becomes particularly problematic when considering business continuity. If email, identity services, learning platforms and key administrative systems are unavailable, the consequences involve almost every function within the school.
The Technology Director may be responsible for coordinating technical recovery, but they cannot independently determine how admissions, finance, teaching, digital safety and school communications will operate during an extended disruption.
Finally, the threat environment is changing faster than many schools' assessment and improvement cycles. AI-assisted social engineering, compromised supplier accounts and emerging vulnerabilities do not necessarily align with annual budget approvals or occasional security reviews.
The result is that schools may have invested in cybersecurity without having sufficient evidence of their ability to withstand and recover from a serious incident.
This is an important theme in our Tech Directors' Guide to AI.
The increasing use of AI is not simply a matter of introducing new applications or managing the risks associated with how staff and students use them. Technology leaders also need to consider how AI changes the external threat environment and the demands placed on their existing infrastructure, security controls and incident response arrangements.
I believe schools should be able to answer several fundamental questions. Do we understand our current technical vulnerabilities, and have we independently tested the effectiveness of our security controls? Could we identify and contain a compromised Microsoft 365/ Google account before it led to a wider incident?
Have we assessed the risks associated with privileged access, identity management, cloud configuration and third-party integrations?
Could we continue essential school operations if our primary communication and collaboration systems were unavailable for several days?
Have we tested our backups and recovery procedures, rather than simply confirming that backups are taking place?
And perhaps most importantly, do the Head, Bursar and governing body understand the operational consequences of a significant cyber incident, and have they agreed the school's risk priorities?
These questions require technical expertise, but the decisions and accountability extend beyond the Technology Department.
At 9ine, we have developed a range of cybersecurity services specifically for schools, combining independent technical assessment, ongoing vulnerability management, specialist testing and practical support for remediation.
Our approach is to help schools understand their exposure, prioritise the risks that matter and implement improvements that strengthen their ability to withstand and recover from cyber incidents.
Our Security & Systems Assessment provides an independent review of a school's technology environment, including infrastructure, configuration, access management, cloud services, backup arrangements, operational practices and cybersecurity controls. The output is a prioritised assessment of the weaknesses and improvements requiring attention.
Our Cyber Security Testing services identify vulnerabilities across school infrastructure, systems and devices. Where deeper assurance is required, we undertake infrastructure penetration testing, web application testing and targeted technical assessments to establish whether identified weaknesses could be exploited.
Through Cloud Security Assessments, we review Microsoft 365 and Google Workspace environments, including identity and access management, security configuration, privileged accounts and the controls protecting school information.
We also offer Red Teaming and social engineering assessments, helping schools understand how attackers could exploit weaknesses involving people, technology and operational processes. This is particularly relevant as AI makes impersonation and targeted phishing more convincing.
Our 9ine Protect service provides recurring vulnerability assessments, expert analysis, prioritised remediation recommendations and access to specialist cybersecurity consultants. The objective is to help schools maintain visibility of their exposure rather than relying solely on occasional assessments.
Alongside these services, our consultants support business continuity planning, disaster recovery, incident response preparation and Zero Trust security programmes. These activities help schools establish what must remain operational during a disruption, how incidents will be coordinated and what is required to restore essential services.
This combination of independent assessment, practical technical support, ongoing testing and governance is important.
Schools do not simply need to know where their vulnerabilities exist. They need the expertise and capacity to address them, and leadership needs evidence that progress is being made.
The Microsoft outage will eventually be resolved. Services will return, emails will be delivered and normal operations will resume. For many organisations, it will quickly become another technology incident that is forgotten once the immediate inconvenience has passed.
I think that would be a missed opportunity. Today's disruption demonstrates how dependent schools have become on connected technology services, and how quickly the loss of those services can affect normal operations.
A successful cyberattack could create similar disruption, but with the additional challenges of investigation, containment, data protection, recovery and uncertainty about whether systems are safe to use.
As AI makes aspects of cybercrime faster, cheaper and more accessible, schools should expect the pressure on their cybersecurity arrangements to increase.
The response should not be to create unnecessary alarm or assume that every school needs the most expensive security technology. It should be to establish a clear understanding of the risks, independently test existing controls, address known weaknesses and prepare for the operational consequences of a serious incident.
The measure of cybersecurity readiness is not simply whether a school has invested in security. It is whether the school understands its exposure, has tested its defences and can continue operating when something goes wrong.
That is the conversation I would encourage every Technology Director to have with their leadership team following today's outage.
Our Tech Directors' Guide to AI explores the changing technology and cybersecurity risks facing schools, including the implications of AI-enabled threats and the governance arrangements needed to manage them.
For schools wanting to understand their current cybersecurity position, 9ine can provide an independent assessment and a practical programme of improvement through our cybersecurity services and platform.
Read the Tech Directors' Guide to AI, or visit 9ine.com to discuss your school's cybersecurity readiness with our team.