Cybersecurity Is a Mirror

When word got out that a widely used learning platform had been breached, the questions that flooded in weren’t about data forensics or threat vectors.

They were:

Can students still access their assignments? Is this login page real? What do we tell families?

Those questions tell you everything.

Not because they’re wrong. They’re completely reasonable. But they reveal what most educational technology decisions are actually built on: the assumption that the platform will always be there. That the vendor will show up and that the convenience we traded something for will keep working every morning.

It usually does.

Until it doesn’t.

And then everyone remembers, all at once, that “the cloud” is still just somebody else’s computer.

Breaches happen. They happen to well-run companies with strong security teams, and they happen to platforms schools rely on every day. No vendor is immune, and singling one out misses the point. The harder questions sit on our side of the relationship.

Here’s what makes me uncomfortable to say. And I say it as someone who has spent years encouraging schools to adopt new tools and move faster.

Most educational technology ecosystems were not designed. They accumulated.

One app to handle communication. Another for intervention data. Another for assessment. Another because the neighboring district was using it. Another because it was free. Another because saying no felt harder than asking why.

(And if you’re reading this thinking that’s not us, I’d encourage you to pull up your current vendor list before you finish the sentence.)

Over time, schools built incredibly complex systems layered across APIs, cloud platforms, student accounts, and data-sharing agreements that most educators have never actually seen. Leadership signed off on integrations the IT team didn’t fully vet. IT approved tools teachers didn’t use. Teachers used tools nobody told leadership about.

That’s not negligence. That’s what accumulation looks like when the pressure to adopt is always louder than the permission to pause.

The breach didn’t create that problem. It just made it visible for a few uncomfortable days.

A Framework for the Conversations That Don’t Happen

This is exactly the kind of situation the CALIE Effective Technology Guidelines were built for.

Not as a compliance checklist. Not as another thing for overextended teams to feel behind on. But as a framework for the conversations that don’t happen often enough, built by educators who have lived inside these same pressures.

The guidelines evaluate technology across five connected domains: student experience, instructional design, evidence of impact, equitable access, and long-term sustainability. What strikes me about that last one is how rarely sustainability shows up in the room when a school is excited about a new platform. We ask whether teachers will use it. We ask whether students will engage. We almost never ask: What happens if this disappears?

That’s not a hypothetical anymore.

The framework is also intentionally designed as reflection, not evaluation, which matters more than it might sound. The goal isn’t to grade your district or shame anyone for the decisions that made sense at the time. The goal is to build a shared language across teams so that the questions people have been quietly holding can finally get asked out loud.

There’s even a three-minute gap analysis tool that helps teams surface where they are right now, before anything else. Not where they should be. Where they are. That’s a different kind of starting point. A more honest one.

The Questions That Rarely Make It Into the Room

Because the questions most schools ask before adopting a platform sound like:

Will students engage? Will teachers actually use it? Does it integrate with what we already have?

Reasonable. I’ve asked them myself.

The questions that rarely make it into the room are the harder ones:

What does this platform make easier to do poorly? What happens to instruction if it disappears tomorrow? Who owns the data our students generate inside it? And what are kids learning about privacy from watching the adults around them click “agree” without reading anything?

That last one is the one nobody wants to sit with.

We build entire units on digital citizenship. We teach students about privacy, consent, and online responsibility. And then adults model exactly what we tell students not to do. Click fast. Approve the integration. Sync the data. We’ll figure out governance later.

(Later has a funny way of arriving in the middle of a security incident.)

I want to be clear about something: this is not an argument against educational technology. That argument is over, and it was never a particularly interesting one anyway.

Technology, used intentionally, can expand access, deepen learning, and create opportunities for students who need them most. That’s the vision. Technology that actually supports what learners can do, not technology that just fills time or solves an administrative inconvenience.

But useful isn’t the same as intentional. And convenient isn’t the same as designed.

Every platform asks for something in return. Attention. Data. Dependency. Behavioral information. Instructional time. Trust. Many schools still evaluate those exchanges almost entirely through the lens of convenience, without naming what’s being traded away in return.

The Uncomfortable Truth

The CALIE guidelines exist because educators deserve a better framework than convenience. And because the students inside these systems deserve adults who are asking harder questions on their behalf.

Some schools now operate inside digital ecosystems so interconnected that almost nobody fully understands the whole system. Not classroom teachers. Not administrators. Sometimes not even the vendors themselves.

That should probably bother us more than whether students are using paper or screens.

Cybersecurity cannot keep living inside the IT department while every other department expands digital dependency without shared governance or shared accountability. That’s not an IT failure. That’s a leadership design problem.

But here’s what I actually believe: the educators in this community already know this. They’ve felt it. They’ve navigated it with limited support and enormous pressure. What’s been missing isn’t awareness.

It’s been a place to start the conversation.

That’s what the guidelines offer. And that’s what this community is for.

If these are questions your school or district has been avoiding, it might be time to stop avoiding them together.

Download the CALIE Effective Technology Guidelines and take three minutes with the gap analysis.