The Sector Everyone Ignores: Why K-12 Is Critical Infrastructure and What We Can Learn From It

No ratings

Presented at BSidesAugusta 2026 by

Eric Logan

Strip away the crayon drawings and here is what K-12 in the U.S. is: an enterprise network serving tens of millions of users, holding Social Security numbers, medical records, disability status, and behavioral data on children, staffed by people whose primary job is not security, under near-constant attack. One breach in 2024 exposed the records of 60 million students and 10 million teachers in a single hit. The sector gets compromised at a rate most industries would declare a national emergency. Nobody is talking about it. This talk draws on the experience of defending a large urban district serving over 92,000 students, 14,000 staff, and 138 schools. It makes the case that K-12 is not a niche problem. It is the most honest stress test available for defending a high-value, data-rich environment with enterprise-scale exposure and a fraction of enterprise-level resources. The threat patterns, governance failures, defender strategies, and hard lessons from K-12 translate directly to any organization doing more with less.