Anatomy of a School Cyberattack: Following an Incident From First Signal to Response

What does a cyberattack on a school actually look like from the inside? This session reconstructs a composite incident drawn from real school environments, step by step. At each stage we'll show what evidence was visible, where it appeared across identity, endpoint, and network activity, and what a defender could have done with it. You'll also see what an effective incident report should give a school leader: what happened, what's affected, and what to do next.