Education & EdTech Penetration Testing

Most institutions worry about the anonymous internet attacker and forget the other two. A curious student with a valid login is an insider with time on their hands, and a phished lecturer hands an attacker a trusted foothold. We test all three, because grade tampering and mass data theft usually start from an account that was supposed to be there.

If you build or resell an EdTech platform, the test looks at multi-tenant isolation, API security and the safeguarding implications of exposing children’s data. A single IDOR that lets one school read another’s pupils is a reportable breach under GDPR, and we hunt for exactly that.

We enumerate your external footprint with nmap and content discovery using ffuf, catalogue every portal and subdomain, and fingerprint the platforms in use. Universities in particular tend to have forgotten departmental servers and old project sites still online, and those are often the way in.

Using Burp Suite we work through authentication, session handling and authorization on the SIS, LMS and portals. IDOR and broken access control top the list here: can a student read another’s records, escalate to a tutor role, or reach an admin function by guessing an endpoint? We test business logic too, such as re-opening a closed exam submission.

Single sign-on is a force multiplier for attackers when it is misconfigured. We test SAML assertion handling, OAuth flows and directory federation for token abuse, weak session invalidation and privilege escalation across the federated apps a single login unlocks.

On internal engagements we check whether student, guest and staff networks are properly separated, and whether campus Wi-Fi leaks onto administrative systems. Then you get a report with an executive summary for leadership and a technical section for IT, each finding scored with CVSS and paired with a concrete fix.

Student portals that expose another learner’s records by changing an ID in the URL are the most frequent serious finding. The same flaw in an SIS API can leak thousands of records at once.

Old departmental web apps, test servers left on the public internet, and research microsites running unpatched software give attackers an easy foothold. We find these during reconnaissance on almost every university engagement.

Missing MFA on staff logins, predictable password resets and SSO misconfiguration let an attacker take over a lecturer or administrator account, then pivot into grades, payroll and personal data.

Mobile apps and integrations often talk to APIs that return more than the screen shows, leaking dates of birth, contact details and safeguarding notes. We inspect the raw responses, not just the interface.

Institutions process large volumes of personal data, much of it on minors. We highlight any exposure that would trigger GDPR breach obligations and flag safeguarding-sensitive data with extra care.

Where you hold ISO 27001 or must satisfy a research funder’s security conditions, the report supplies the independent technical-testing evidence, cross-referenced to control A.12.6 on vulnerability management.

A ransomware hit during term can shut down teaching, lock staff out of records, and delay exams. The usual entry is a phished staff account or an exposed remote-access service, followed by lateral movement across a flat network. We test exactly those paths so you can break the chain before it is used against you.

Student and staff records sell well and expose the institution to GDPR action. A single broken API or an SIS access-control flaw can leak thousands of records at once, which is why we focus so heavily on authorization rather than surface-level issues.

Not every threat is external. A student who finds they can change a grade, or a compromised tutor account with broad access, does real damage. Testing the authenticated view surfaces these before they become an incident report.

Smaller institutions usually start with the public portal and the platforms holding pupil data, plus a check that guest and staff networks are separated. It is a focused, affordable engagement that covers the highest-risk assets first.

Larger institutions have sprawling estates, federated identity and sensitive research data, so the test is broader and often phased across departments. Research data under a funder’s security conditions gets particular attention, since a breach there can jeopardise grants as well as reputation.

Platform vendors need multi-tenant isolation and API security tested to prove that one customer’s data cannot reach another. That evidence is now a routine part of selling into the education market.

Findings are written so a developer can reproduce and fix each one without guesswork, and we answer questions from your team as they work through the list. Where a fix is not obvious, we suggest a concrete approach rather than leaving you with a problem statement.

Once you have remediated, we retest the reported issues at no extra cost and confirm each one is closed. You then have documented proof, for governors, auditors or funders, that the weaknesses were found and fixed.

Term brings constant change: new systems, new integrations, new intakes of users. Many institutions move to an annual or per-major-release cadence so security keeps pace with the estate rather than being a one-off snapshot.