Paramount School District is a K-12 school district in southern California, serving around 15,000 students. It runs multiple sites, including one large 4,000-student high school, four middle schools, and several elementary schools, alongside one location specializing in adult education. The district employs 2,000 staff, including teachers, administrators, and a lean security team of just 12 people – including two network analysts.
The US education sector has been relentlessly targeted during the pandemic, as threat actors seek to capitalize on perceived weaknesses such as funding challenges, stretched IT teams and risky user behavior—especially students with network access. The unexpected transition to remote learning exposed school networks to more threats, as staff and students logged on with potentially compromised personal devices, and attackers took advantage of users being more distracted at home. The figures speak for themselves: The non-profit K-12 Security Information Exchange reported an 18% year-on-year surge in publicly reported security incidents in 2020. Separate research estimates such attacks may have cost US schools and colleges nearly $7 Billion that year.
For Paramount School District, the risk of attack was amplified because it offers network access to users from the wider local community. In addition, the pandemic meant more employees were actively using their email accounts to access the district’s network than ever before, including maintenance workers, part-time nutritional staff, and others. Increased email usage created a greater risk of email-related threats getting through existing defenses.
Human error often lies at the heart of email-borne cyber risk, and so the district downloaded free educational tools from phishing training services to try to improve user awareness of such threats and even crafted its own banners to flag threats in user inboxes, but these had limited success. The Microsoft Essentials solution was effective in detection but required staff to manually purge the system of phishing emails following an outbreak. Such efforts could take hours to complete, by which time users had often already clicked through.
The district was looking for an email security solution to block threats more effectively, provide rapid incident response for stretched IT staff, and deliver enhanced educational content to change user behaviors.
The district first became aware of IRONSCALES in September 2021 after researching the email security space. They found the demonstration process simple and effective. The district was up and running within half an hour in a controlled environment. The vetting process lasted 45 days. This time was needed to vet the credentials of the product to the school board. Following this review, the team was so impressed with the IRONSCALES solution that it signed a three-year agreement.
The implementation process was simple for the Paramount School District team, who were assigned a dedicated IRONSCALES engineer for any deployment questions. The team was able to contact IRONSCALES quickly and easily, even after-hours, to have any queries successfully resolved.
With IRONSCALES in place, the district has been able to improve security awareness among users, enhance the productivity of its IT team, and ultimately block email threats more efficiently. IRONSCALES has enabled the security team to customize alert banners with personalized messages, providing users with clear instructions on what to do if they suspect a threat. This has both helped improve user education and increased incident reporting. Because IRONSCALES only alerts users when it suspects malicious activity, banner fatigue has been eliminated, and the mobile app ensures users are just as protected from home as when they’re working on site.
Although the district has yet to leverage the training and phishing simulation features in the product, it has noticed greater awareness among the community and has received extremely positive feedback.
Incident tickets have also significantly dropped thanks to the IRONSCALES solution, which is now blocking more threats and autonomously remediating incidents when required. The solution remediated 18,579 emails in a 90-day period, freeing up IT staff time that would have otherwise been spent on purging inboxes. Based on industry calculations, the solution saved over 377 hours of IT time in the same 90-day period. That’s the time that the team is now spending on being more proactive with other projects. There’s also a benefit to the district’s other employees, who are less exposed to timeconsuming, post-compromise events such as password changes.
Going forward, Paramount School District is set to embrace the education features in the product, including regular phishing simulation campaigns. This will help the organization to maintain high levels of user awareness on an ongoing basis.