Your school holds the most sensitive records there are.
Children's details, medical notes, fee payments, parents' phone numbers. All of it sits behind a website, a portal and a handful of staff email accounts. Find out in minutes where your school stands, starting with the part anyone on the internet can already see.
Check your school's website now
A security test built for schools
A penetration test means a qualified tester tries to break in the way a real attacker would, with the school's written permission, and then shows you exactly what was found and how to fix it. For a school it usually covers five areas.
School website and online forms
Enrolment, contact and application forms, and where the children's details they collect end up.
Parent and pupil portals
Whether one family can see another family's reports, fees or records, and how strong the sign-in is.
Staff email
Microsoft 365 or Google Workspace sign-in, two-factor coverage, and whether someone can send email that looks like it came from the bursar.
Wi-Fi and the school network
Whether the pupil and guest Wi-Fi is properly separated from the admin, finance and records systems.
Remote access
VPNs, remote desktop and any system staff reach from home.
How it runs
- Written authorisation from the school and an agreed scope before any testing starts
- Testing scheduled for the holidays or outside teaching hours, so lessons are not disrupted
- Done by the founder personally, never handed to a junior or a reseller
- One report written for the head and the board, with a technical section for IT
- A free retest once the fixes are in, so you can show the problems are closed
School security test
from $1,200
Website only audit from $500. One fixed written quote before anything starts. Half to book your dates, the balance on delivery of the report.
Ask about testing datesThe December holidays are the easiest window to test without disrupting lessons.
Almost every school is over the licence threshold
Under Statutory Instrument 155 of 2024, an organisation holding the personal data of 50 or more people needs a data controller licence from POTRAZ. Pupils, parents and staff are counted together, so a school with a few dozen pupils is already there. The deadline was 12 March 2025.
The licence is paperwork with POTRAZ. What sits behind it, how the records are actually protected, is what we help with.
Does your school need a licence?
Six questions, two minutes, and a clear list of what to do next.
Take the licence checkerWhere school systems usually let data out
Fee payment fraud through staff email
An attacker who gets into, or convincingly copies, a bursar's mailbox can send parents new banking details. It needs no hacking of the school's systems at all, which is why email spoofing protection matters.
Parent and student portals
Anything with a login holds exactly what a school must protect: names, classes, reports, sometimes medical notes. Weak access control can let one parent see another family's records.
Enrolment and contact forms
Website forms collect children's details. Where that data goes after the form is sent, and who can read it, is usually the least examined part of a school website.
Shared and reused passwords
One admin password known to several staff, never changed when someone leaves, is the most common way in. Two-factor sign-in closes most of it.
What would testing cost?
Pick what should be tested (website, portal, staff email, Wi-Fi) and see the right test and its starting price in about a minute.
Build your scopeSee what you would receive
A redacted report in the exact format a school gets: every finding, how serious it is, and the fix, written for the head as well as IT.
Open the sample reportQuestions schools ask first
- How much does a security test for a school cost?
- A penetration test starts at $1,200 and a website only security audit starts at $500. The fixed price depends on how many systems are in scope, for example a website alone, or a website, portal, staff email and Wi-Fi together. You get one written quote before anything starts.
- Will testing disrupt lessons or exams?
- No. Testing is scheduled for the holidays, weekends or outside teaching hours, agreed with you in writing, and stops straight away if anything looks affected.
- Will you see pupils' records?
- The aim is to prove whether records can be reached, not to read them. Where a weakness exposes personal data we stop at the minimum evidence needed to show it, record it in the report, and handle it under the confidentiality terms agreed with the school.
- Does the report help with the POTRAZ licence?
- It shows how the records you hold are actually protected, which is what the licence and the Cyber and Data Protection Act expect a school to be able to demonstrate. The licence application itself is made by the school to POTRAZ.
- Do you work with schools outside Harare?
- Yes. Website, portal and email testing is done remotely from anywhere in Zimbabwe. On-site Wi-Fi and network testing outside Harare is quoted with travel.
Talk it through with the person who does the work
Testing is scheduled around the school calendar, agreed in writing before it starts, and done by the founder personally.