According to Jan Bakker of APS IT-diensten, the pressure on schools to get their cybersecurity in order keeps growing. “And that comes on top of schools’ core task: providing good education.” Password management remains the ‘low-hanging fruit’ here: a crucial first step toward structural digital resilience in education.

What is there to gain in education?

Jan Bakker has worked in education IT since the 1980s and has watched its development up close. “We’ve gone from floppy disks and on-premise servers to fully cloud-based environments. The technology has changed, but the responsibility to get it right has stayed.”

In primary education, solutions from parties such as Microsoft and Google are now used on a massive scale. The move to SaaS and the cloud has taken a lot of management off schools’ hands, but according to Jan, that certainly doesn’t mean schools can sit back. “On the contrary, you can outsource a lot, but you do have to keep fulfilling your role as the one in charge. Contract management, safeguarding privacy agreements, supervising suppliers: all of that is only becoming more important.”

Jan calls the idea that schools are not an interesting target for cybercriminals a misconception. “Educational institutions consistently rank high on the lists of sectors that get attacked. Yet the perception is often: what could anyone possibly gain from us?” The answer is simple: data. Student data, health and care information, test results, and personnel files are valuable. Moreover, schools work with many users and relatively open infrastructures.

“It only takes one weak link,” says Jan. “One data breach, one compromised account, and you have a serious problem.”

The balance between control and innovation

Schools must comply with the information security and privacy framework, part of the Digitaal Veilig Onderwijs (“Safe Digital Education”) program. That calls for growth toward a higher maturity level, with attention to policy, technology, and organization. At the same time, however, schools want to keep innovating and respond to technological developments.

In practice, the starting positions differ greatly. “Large school groups can centralize functions and benefit from economies of scale,” says Jan. “But there are also individual schools where IT is simply handled on the side. There’s a whole spectrum in between.” According to him, the increasing scale of the education sector does help. “That consolidation wave ultimately leads to further professionalization and therefore more security.”

The rise of AI makes that balance even more urgent. Tools such as Microsoft Copilot are increasingly used in education. “You see people starting to experiment with all kinds of AI applications, often with school data. Then you constantly have to ask yourself whether that’s safe.”

Banning them is not the answer, according to Jan. “If you do nothing, you stand still. But you do need to know what happens to your data.” The challenge for schools is therefore to make room for innovation while keeping a grip on the risks.

Start with the everyday vulnerabilities

Rather than getting lost in complex issues such as AI, cloud governance, and DPIAs (Data Protection Impact Assessments), it is important to start with the everyday vulnerabilities, says Jan. In practice, he sees employees at schools working with countless applications, passwords being reused or shared, and multi-factor authentication not always being set up consistently. “If you start there, you’re already taking an enormous step.”

According to Jan, it helps to make that vulnerability tangible. “If you show what is actually happening with passwords within an organization, the conversation starts by itself.” Baseline measurements show where the risks lie and allow board members, together with their IT managers, to make more targeted choices. Moreover, professional password management directly contributes to improving the maturity level within the framework.

Password management as a foundation

Following that reasoning, Jan also looks favorably on a solution like MindYourPass. For him, the choice is not about marketing or brand preference, but about practical and governance considerations. The central questions are always: does this solution demonstrably reduce risk, and is it feasible within the school organization?

Several factors play a role here. A solution must provide visibility and control, but also fit the existing infrastructure, often based on Microsoft or Google environments. “It has to fit the reality of the school,” he emphasizes. If the implementation is too complex or too labor-intensive, it never gets done. In addition, the solution must also be financially feasible.

Privacy and origin also weigh in. Schools, too, increasingly want to know where their data is processed and under which legal frameworks. In that light, transparency and European safeguards are becoming ever more important.

Ultimately, Jan sees professional password management not as an end point but as a foundation. Using a tool is not a goal in itself; it is about getting a grip on a concrete, daily risk. In that context, he believes MindYourPass fits the choices schools now have to make to structurally strengthen their digital foundation.