This module is part of Engaged Learning’s My Online Safety multimodal series.
Fluent in French?
Refer to Ma sécurité en ligne.
Whether it’s recognized or not, schools now operate in a digital environment where threats are difficult to detect—and sometimes entirely invisible. The management of sensitive data, the widespread use of tools with varying levels of security, and the rapid rise of artificial intelligence all contribute to increased exposure, while also making schools more strategic targets. More than ever, schools play a key role in helping students develop essential habits: protecting themselves, verifying information… and exercising critical thinking.
Cybersecurity can no longer be considered the sole responsibility of specialists or technical staff. It now affects the daily lives of students, staff, and families. It spans across teaching practices, communication, data management, digital citizenship, and even school climate. In today’s context, artificial intelligence makes fraud more convincing, personal information circulates widely across digital platforms, and misinformation is becoming increasingly sophisticated. As a result, learning how to protect oneself, verify information, and take action is becoming a foundational skill.
In 2025, the education and research sector accounted for 34% of incidents handled by France’s national cybersecurity agency (ANSSI), making it the most affected sector in its annual report. In the United States, school districts experience an average of five cyber incidents per week, while in the United Kingdom, up to 60% of secondary schools report having experienced a breach in the past year—clear signs that the education sector is among the most targeted. In Canada, the National Cyber Threat Assessment also highlights that organizations must contend with cybercriminals who are increasingly able to leverage AI to personalize their attacks.
In just a few years, the landscape has changed. Technologies have permeated every aspect of school life: learning, communication, assessment, administration, and collaboration.
If the education sector attracts so many cybercriminals, it is no coincidence. Schools hold a vast amount of sensitive information: family contact details, academic records, individualized support plans, health information, behavioural data, administrative records, and sometimes even financial data. A significant portion of this information relates to minors, which further increases the legal and ethical responsibility of schools to ensure its protection. In Quebec, this responsibility is notably framed by legislation governing the protection of personal information applicable to public bodies and private organizations.
However, the value of the data does not tell the whole story. The education sector also faces a very real structural vulnerability. Schools rely on a wide range of devices, uses, and platforms, including shared computers, tablets, wireless networks, collaborative tools, learning management systems, cloud-based services, specialized software, remote access, and multiple user accounts. This complexity multiplies the number of potential entry points for cyberattacks. Added to this is a well-known reality in the field: schools do not always have the same technical, financial, or human resources as larger organizations to prevent, detect, and respond to incidents.
The consequences of a cyberattack go far beyond a technical issue. An attack can disrupt services, block access to essential tools, compromise the continuity of learning, expose personal data, and significantly undermine trust among families. Cybersecurity therefore becomes an issue of governance, safety, well-being, and institutional credibility.
Cybersecurity: A Pedagogical, Organizational, and Human Issue
Schools today are data-rich environments and, as a result, highly attractive targets. Contact information, student records, individualized education plans, health information, and digital identities all represent sensitive data, often linked to minors.
Add to this:
…and you have a fertile ground for cyberattacks.
In a school setting, a cyberattack can:
Generative artificial intelligence has significantly transformed the threat landscape. For a long time, people were taught to spot fraudulent emails by obvious spelling mistakes, awkward tone, or implausible wording. That cue is no longer sufficient. Today’s phishing messages can be well-written, personalized, context-aware, and tailored to the recipient’s language. The Canadian Centre for Cyber Security also notes that generative AI makes social engineering attacks more convincing and effective.
Deepfakes add another layer of concern. It is now possible to create highly realistic voices, images, and videos to impersonate a school leader, parent, colleague, or even a student. In 2024, a case in Hong Kong revealed that an employee was deceived during a fake video conference featuring AI-generated versions of colleagues, leading to fraudulent transfers totalling approximately CAD 35 million. This type of scenario, once considered exceptional, now clearly illustrates what digital manipulation can make possible.
In school settings, these threats can take many forms: a fake message appearing to come from school administration; a manipulated video circulating among students; a rumour amplified by AI; an image taken out of context; or a fraudulent notice sent to families. The issue is not only technological. It also affects trust, reputation, consent, judgment, and the ability to distinguish between what appears to be true and what actually is.
AI Is Changing the Rules of the Game
For a long time, students were told:
“Be wary of emails with spelling mistakes.”
That cue no longer holds.
Today:
Welcome to the age of deepfakes.
A Concrete Example
A voice message appears to come from school administration.
It requests urgent action.
Everything seems real.
And yet… it isn’t.
Students grow up in a constantly connected digital world. They use technology to learn, to be entertained, to communicate, to build relationships, and sometimes even to shape their identity. This environment exposes them to a range of risks that go far beyond the issue of passwords.
Well-known threats remain highly prevalent, including phishing, malware, account takeovers, fake contests, malicious links, and attempts at extortion or impersonation. In addition to these, students also face social risks such as cyberbullying, interactions with strangers, exposure to inappropriate content, viral humiliation, and the non-consensual sharing of images. The Government of Canada, through its Get Cyber Safe initiative, continues to emphasize simple but essential practices. These include using unique passwords, relying on password managers, enabling multi-factor authentication, and regularly updating devices and applications.
It is also important to remember that young people do not always fully understand the extent of their digital footprint. A post made in the heat of the moment, a photo shared without careful thought, or a mocking comment can leave lasting traces. The Office of the Privacy Commissioner of Canada has, for several years, stressed the importance of educating youth about online reputation, privacy, and the responsible management of their personal information.
Today, information-related risks must also be taken into account, including misinformation, fabricated images, AI-generated text, content taken out of context, filter bubbles, and emotional manipulation. Cybersecurity is therefore not limited to avoiding viruses. It also involves developing a critical approach to evaluating messages, platforms, and perceived credibility.
Students: Exposed… but Also Empowered to Act
Young people are not only vulnerable. They are also on the front lines—and can become active participants in their own safety.
Most common risks:
These risks highlight important skills that students need to develop.
The good news is that taking action does not require creating an entirely new cybersecurity course. Across Canada, these issues are already present in curricula, often through a cross-curricular approach.
For example:
This mapping highlights an important point: cybersecurity is rarely taught as a standalone subject; rather, it is embedded across multiple disciplines. In language arts, it may involve the critical analysis of a message or a rumour. In science and technology, it may involve understanding systems, networks, and data. In mathematics, it can relate to logic or introductory concepts in encryption. In culture and citizenship education, it can address ethical issues, reputation, privacy, and respectful online behaviour. The real challenge, therefore, is not only to add new content, but to better connect what already exists.
The school’s objective should not be to instill fear, but to empower young people to act with discernment. Cyber resilience rests on a few simple, yet powerful pillars.
First, there is cyber hygiene. Students need to understand that a password is not a mere formality, but an important protective barrier. They should learn how to create long passphrases, avoid reusing passwords, use multi-factor authentication, and keep their devices and applications up to date. These are concrete, transferable, and immediately useful practices. Public guidance from the Government of Canada strongly supports these approaches.
Next come digital identity and reputation. Students need opportunities to reflect on what they post, what they share, and what they leave behind. Every click, every message, and every image shared can either build or undermine a reputation.
There is also the ability to verify information. In a world where AI makes highly convincing manipulation possible, students must learn to slow down, apply informed skepticism, cross-check sources, verify the origin of an image, and question who is speaking, why, and for what purpose. Resources such as those developed by MediaSmarts or Brilliant Labs offer valuable support for schools in this area.
Finally, there is digital respect. Cybersecurity is not only about devices and access—it is also about how people treat others online. Preventing cyberbullying, fostering digital empathy, understanding consent, and recognizing the emotional impact of online interactions are all integral parts of this learning.
👉 The “digital safety basics”
👉 Learning to question wisely
👉 “The Internet never forgets”
👉 Keeping people at the centre
Teachers do not need to become experts in advanced cybersecurity to play a central role. Their strength lies elsewhere: in their ability to create meaning, make connections, model good practices, and guide students.
In practical terms, this means drawing on current events as learning opportunities. A viral fake message, a questionable video, a circulating rumour, a hacked account, or a controversy related to AI can all serve as opportunities to develop critical judgment. It also involves adopting consistent practices themselves: locking their sessions, verifying sources before projecting a video, reflecting on the data they collect or share, reporting incidents promptly, and explicitly naming the safety practices they use.
From this perspective, teachers do not become technicians. Rather, they become a compass—helping students navigate an environment where credibility can be artificially constructed and where appearances are no longer sufficient.
🧭 The Teacher: A Compass, Not an Expert
Teachers do not need to be cybersecurity specialists. Their role lies elsewhere.
They are:
In practice
📌 Quick Reference
Here is a simple, hands-on activity to help teach the basics of cybersecurity to elementary students using everyday objects. It makes abstract concepts more concrete and easier to understand.
In a “survival kit”—for example, a plastic bag—place a padlock, a key, a tube of toothpaste, a magazine, a pair of sunglasses, and a permanent marker.
Here is what these objects represent when discussing cybersecurity and digital citizenship:
The padlock 🔐
It reminds students to:
The key 🔑
When presenting it, explain that it is the key to their home. This is a way to show that, just like passwords, it should never be shared with others—except with parents or guardians for students under 14.
The permanent marker 🖊️
It illustrates that anything posted online may never truly disappear—even if you click “Delete.” Someone may have already reshared it or taken a screenshot.
The sunglasses 🕶️
They remind students that what we see online is not always reality. Much of what we see is filtered, but by whom, and for what purpose? Just because something appears darker through the lenses does not mean it actually is. (This can also be turned into a fun activity using tinted glasses—pink, yellow, or other colours!)
The tube of toothpaste 🪥
It shows that, like content shared online, once the toothpaste is out, it cannot be put back in the tube. You can also use a sheet of paper that you tear—once torn, it is difficult, if not impossible, to put back together.
A newspaper or magazine cover 📰
It reminds students not to post something publicly on social media that they would not want to see on the front page of a newspaper. You can also introduce the “grandmother test”: would I want my grandmother to see this?
No school-based cybersecurity initiative can be fully effective without a strong connection between school and home. Students move seamlessly between environments: classroom, phone, home, online games, messaging apps, and social platforms. As a result, the messages shared at school are most effective when they are reinforced at home.
This is why the most useful tools are often those that support genuine home-school collaboration. A family agreement on digital use and online respect, for example, can help establish clear guidelines around passwords, privacy, consent, screen time, privacy settings, and open communication in the event of discomfort or an incident. The goal is not to impose excessive control, but to build a shared language and common habits.
Several tools and templates have been developed specifically to support families in creating such an agreement. Here are some examples:
When schools and families work together, the impact is amplified. Cybersecurity then becomes not just a one-time message, but a shared culture.
The Multiplier Effect: School + Home
Cybersecurity doesn’t stop when the bell rings. Students move between:
Consistency is therefore essential.
🏡 A Key Tool: The Family Digital Agreement
A simple agreement can include:
👉 This type of tool helps turn prevention into a shared culture.
The topic may seem complex—even daunting. Yet it offers a powerful educational opportunity. Talking about cybersecurity in schools means talking about judgment, responsibility, respect, critical thinking, citizenship, and agency. It means helping young people understand the world as it is—not as we might wish it to be.
This work is all the more essential as technologies continue to evolve rapidly. Yesterday’s reference points are no longer sufficient. Fraud is more convincing. Misleading content is easier to produce. Digital footprints are more pervasive. Platforms are more deeply embedded in everyday life. Expecting students to learn how to navigate this environment on their own would be like asking them to find their way through a complex landscape without a map or a compass.
Schools therefore have a fundamental role to play: not to turn every student into a technical expert, but to prepare young people who can protect their access, their data, their reputation, their judgment, and their relationships. Young people who understand that cybersecurity is not just about tools—it is a core life skill.
In an era of platforms, massive data flows, and generative AI, cybersecurity has become an essential dimension of education. It is no longer a simple technical add-on or a one-time workshop. It touches on the protection of minors, the continuity of learning, trust in institutions, privacy, media literacy, and digital citizenship.
The greatest challenge may not be convincing people that the issue matters. Rather, it is making it tangible, cross-curricular, and actionable. Because that is where it all happens: in everyday habits, in classroom activities, in conversations with families, in connections across disciplines, and in the ability to verify before believing, to think before posting, and to act before an incident escalates.
Building cyber-resilient students today means giving them the tools to live and learn with greater safety, clarity, and responsibility in the digital world that is already theirs.
It is recommended to complete this exercise as a group, with at least one member of the leadership team, an instructional/pedagogical advisor, and a teacher leader.
Adapted for Grade 10 students (ages 15–16). A certificate of completion is available to download once all questions are successfully completed.
Bookmark this link and share it with your colleagues!
👉 🔗 https://engaged-learning.com/tag/my-online-safety
This module is part of Engaged Learning’s My Online Safety multimodal series.
Get the latest articles and curated highlights from our current magazine edition—delivered to your inbox every month.
If you are subscribed, log in to access exclusive member content!