· By Nicholas “Nick” O'Sullivan, Townsville
School boards and the cyber storm: what ASD's frontier AI guidance means for education governance
A school board sits on some of the most sensitive data held by any community organisation: staff employment and payroll records, family financial details, and pastoral care and wellbeing notes on children. Several of Australia’s independent schools have had that data compromised in recent years, and the pattern is a familiar one — attackers don’t just lock systems, they exfiltrate the data first and then pressure both the school and its families directly. A school council or board that treats cyber as a line item in an annual risk register review is not matched to that threat.
The accountability picture has shifted alongside the threat. Regulators and government have been explicit that cyber risk sits with the board, not with whoever runs the IT department. That expectation isn’t written with a carve-out for education — a school board, parish council or foundation board is still the body accountable for how sensitive data in its care is protected, and for whether it asked the right questions before an incident rather than only after one.
In practice, most school boards still handle cyber the way many corporate boards did a decade ago:
- Cyber surfaces briefly inside a finance subcommittee’s annual risk register review, rather than as its own standing item.
- No board member has real cyber security background, and there is rarely a dedicated IT or cyber subcommittee at all.
- Where a subcommittee does exist, it’s often chaired by someone with general business or education experience rather than security experience.
- The prevailing assumption — reasonable a decade ago, not reasonable now — is that this is a technical problem the IT team or outsourced provider will simply handle.
It’s worth acknowledging why AI has become part of this conversation at all: used well, it’s a genuinely exciting development for defenders. AI can already help smaller organisations do things that used to require a security team they couldn’t afford — triaging alerts, prioritising which vulnerability to patch first, spotting unusual account behaviour, and drafting the first version of an incident response note.
The uncomfortable other half is that the same capability is available to whoever is trying to get in. In the wrong hands, AI does the same jobs for an attacker that it does for a defender:
- Researching a school and its staff to write a convincing, individually-tailored phishing email, instead of a generic one.
- Scanning for and identifying software vulnerabilities far faster than a person could.
- Chaining several small, low-severity weaknesses together into one serious compromise.
- In some cases, carrying out parts of an attack with little to no human oversight at all.
Neither side of that equation is hypothetical, and it’s precisely why boards — not just IT teams — now need a view on how AI is being used both to protect the organisation and against it.
On 5 August 2026, the Australian Signals Directorate (ASD) published Frontier AI cyber threat considerations for boards of directors, developed with input from the Australian Institute of Company Directors. It is written for boards generally, but it lands squarely on the gap most school boards have. Attacks that used to take days can now take hours — a timeline compression that matters most to organisations that were already slow to notice a breach, and dwell time in under-resourced environments is exactly where schools tend to sit.
Translate that into a typical school’s technology footprint and the exposure is easy to see. A single school will typically run all of the following, each one its own vendor relationship and its own supply chain the school usually cannot see into:
- A learning management system.
- An enrolment and finance platform.
- A pastoral care or wellbeing case management tool.
- A parent communication app.
- Cloud file storage.
- CCTV and building access control.
- A long tail of smaller ed-tech subscriptions bought department-by-department over several years.
ASD is explicit that boards need visibility not just of their own systems but of “third and fourth-party suppliers” — the vendors their vendors depend on. Few school boards could currently answer that question about their student information system provider, let alone the smaller tools sitting underneath it.
ASD frames its guidance as a set of threshold questions boards should be putting to management. Several translate directly into a school governance context:
- How vulnerable are we to an AI-enabled attack against our enrolment, finance or pastoral care systems?
- What legacy technology are we carrying — on-premise servers, old file shares, unsupported software — and do we have a genuine plan to retire it, or are we hoping it lasts one more year?
- Do we have oversight of the ed-tech vendors we rely on, including who they in turn rely on?
- If one of our core systems were compromised tomorrow, could the school keep operating — attendance, payroll, communication with families, pastoral care — while it responds?
ASD also sets out priorities boards should be overseeing rather than delegating silently:
- Securing system configurations and reducing exposed attack surface now.
- Identifying and remediating known vulnerabilities on a defined timeframe.
- Replacing or properly compensating for legacy systems.
- Enforcing least-privilege access, including for any AI tools staff are already using.
- Making sure incident response and business continuity plans have actually been tested — not written once and filed.
For a school, that last point deserves particular emphasis. Many schools rely on a generic emergency or critical incident plan built for physical safety events, which is a poor substitute for a cyber-specific plan that names who makes decisions, who is contacted externally, and how the school continues teaching and pastoral care while systems are offline.
None of this requires the board to become technical. It requires the board to govern the risk the way ASD is now describing for every sector:
- Cyber security reported to the board as its own item, separate from general IT reporting and separate from IT spend.
- At least one voice at the table — a director or a retained adviser — who can ask informed questions rather than accept reassurance at face value.
- An independent view of the school’s actual exposure, rather than relying solely on the people who built or manage the environment to mark their own work.
That independent view is exactly what a Leadership Technology Review is built to give a school board: a plain-English audit of what systems and data actually exist, what’s fragile or exposed, where legacy infrastructure is quietly carrying risk, and what a realistic, staged plan to close the gaps looks like — before it becomes something the board finds out about from a ransom note or a call from a parent. From there, the practical work for most school environments tends to sit across a handful of areas:
- Separating staff, student, guest, AV and access-control networks properly (see our network and infrastructure work).
- Locking down Microsoft 365 or Google Workspace tenant administration and file sharing.
- Getting a lifecycle and access plan in place for the shared and staff devices that move through a school every year (see device management).
Suburban Secure’s schools and ministries page sets out how these pieces fit together for education and faith-based environments specifically.
Frontier AI has not created school cyber risk — it has compressed the timeline in which an existing weakness turns into an incident. Boards that put cyber on the agenda now, ask the questions ASD has just published, and commission an independent review of what they’re actually carrying, are acting while it’s still a governance decision rather than a crisis response. Get in touch to talk through what a review would look like for your school or organisation.
