Cybersecurity Month at APS

The APS Information Security team shares important tips and reminders for staff.

Did you know that 82 percent of K-12 schools experienced a cyber incident last year, and 1-in-3 K-12 districts were hit in 2025 alone?

This month is dedicated to helping you stay ahead of emerging threats. With more sophisticated attacks and AI-powered threats evolving faster than ever, being aware of and prepared for cybersecurity risks is key. We will break down the top cyber threats and risks for K-12, share simple tips to stay safe, and walk through real-world cases. But what is a cybersecurity risk and why does it happen?

To understand it, let's learn three key concepts: Risk, Threat and Vulnerability.
- Risk: How likely a potential event or situation is to happen and the magnitude of harm
or adverse impact that it can cause.
- Threat:  The cause of that harm. The who or what that attacks.
- Vulnerability: A weakness that can be exploited by a threat.
- Consequences: Impacts if a threat actually happens

Let’s see a practical example: Imagine you live in an insecure neighborhood. The risk is that someone breaks into your house and steals something or causes damage. The threat is the thief. The vulnerability is your weak door lock that makes it easy for them. The consequences could be the loss of money, jewelry or important personal belongings.

So, what should you do? Look for a cost-effective control to address the vulnerability and reduce the risk, for example: add a secondary lock, install an alarm or security camera.

It's the same in the digital world. A cybersecurity risk* is that someone gains access to your student, employee, or bank account and steals money or your personal information to commit fraud or demand a ransom. The threat could be a hacker or a malicious program. The vulnerability could be a weak or reused password, a shared account, an outdated app, a shadow IT or AI they can exploit. The consequences are loss of money, impersonation or even extortion in addition of loss of peace.

So, what should you do? Look for a cost-effective control measure to address the vulnerability and reduce the risk, for example: use unique, secure passwords; back up your data regularly; keep your software and antivirus up to date; do not share personal information with AI tools; and think before clicking on a link, image, or file.

The importance of managing cybersecurity risks in APS
Cybersecurity is a shared responsibility: We protect more than just computers or
systems. We protect student data, grades, family and employee information, and
valuable learning time, which makes us a favorite target for hackers. One weak password
or one shared login can put our whole community at risk.

Beyond potential data loss, operational disruption, loss of learning days or financial losses, there is irreparable emotional distress, feelings of vulnerability and powerlessness, reputational damage, and years of recovery.

Being aware of the top cybersecurity risks and how to face them is the first step, but this
is not enough anymore; acting is what keeps our schools safe. For this reason, our
invitation is: Take action, Be Proactive.

Follow our weekly Cybersecurity Month updates and together let’s use and build habits that protect what matters most to us, our kids, families, and classroom environment.

*Cybersecurity risk relates to the loss of confidentiality, integrity or availability of
information, data or information (or control) systems and reflects the potential adverse impacts to organizational operations. (https://csrc.nist.gov/glossary/term/cybersecurity_risk)