Penetration Testing for Schools: What You’re Actually Paying For

Most schools, colleges and multi-academy trusts now commission a penetration test at least once a year. This may be because cyber insurers require it, funding conditions sometimes demand it, or they’re simply being proactive about cybersecurity and keeping staff and students safe.

Or sometimes, it can be because another educational institution gets hit, and the school governors now want the reassurance that someone has tried to break in before a criminal does.

Whatever the reason, regular penetration testing is always a good idea.

The trouble is that two very different services are sold under the same name at very different prices, and it’s easy to pay for one, think you’re getting the other, and find your cybersecurity posture no better than before.

One of these services is a qualified consultant spending several days probing your systems the way a real attacker would. The other is largely an automated vulnerability scan with a report template attached.

Both can appear on a quote as a “penetration test,” but only one is what your insurer, your auditors and your families assume you have bought.

This guide isn’t an argument against automation; on the contrary. Automated scanning has a genuine role, which I’ll come to shortly. It’s an argument for knowing what you’re paying for, so you can choose deliberately rather than accidentally.

Why Penetration Testing Matters in Education

Schools and colleges hold an unusually sensitive mix of data. Safeguarding records, SEND information, free-school-meals status, medical notes, the personal details of children who cannot consent for themselves; the list goes on and on.

Over the last few years, the ICO has taken enforcement action against several education settings where pupil and staff data were exposed, and the National Cyber Security Centre has issued repeated alerts about ransomware and phishing targeting schools and trusts.

What’s the Difference Between Automated Scanning and Human-Led Penetration Testing?

In simple terms, a scan tells you which doors have a known weak lock, while a skilled tester shows what happens once someone gets through that first door. 

Can they move from a library PC to the Management Information System (MIS)? Does a compromised parent-pay account expose anything else? Is your cloud tenancy configured to contain a breach or to amplify it?

An automated tool can’t do that chain of reasoning and contextual understanding well, and it’s also the part that matters most when children’s records are at stake.

Automated vs Human-Led Penetration Testing: How to Tell the Difference

You usually don’t need technical knowledge to tell the difference because the signals are commercial and procedural, and they appear before any testing begins.

The price doesn’t add up.

A genuine human-led engagement involves a qualified consultant for several days, plus time for reporting. If a quote for a “full penetration test” of your network comes in at a few hundred pounds, the arithmetic doesn’t support a person doing the work.

That price buys a scan, which is not a problem, provided that’s what you wanted.

There’s no named consultant.

Ask who will actually be doing the testing, and ask for their qualifications by name.

A reputable provider will tell you, because the work is done by an identifiable individual who stands behind it. 

If you can’t get a name, or the answer is some version of “our platform handles that,” you’re being sold software rather than expertise.

There’s no scoping conversation.

Human-led testing starts with a discussion. What systems are in scope? Are there fragile legacy applications that mustn’t be knocked over during exam season? Is the MIS hosted by a third party that needs to authorise the work?

A provider who sends a quote without asking any of this either intends to run a generic scan against whatever IP addresses you hand over, or hasn’t thought about your environment at all.

Qualifications and methodology are answered vaguely.

It’s reasonable to ask which framework a provider follows and what certifications their testers hold. In the UK, look for CHECK (the NCSC scheme), CREST membership, or recognised individual qualifications such as OSCP and CRT.

A provider doing serious work will answer these questions readily. Hesitation, or marketing language where a straight answer should be, should tell you everything you need to know.

Data residency and GDPR are unclear.

A penetration test report is a catalogue of exactly how to compromise your systems. Where is that report stored, and under whose jurisdiction?

If testing or reporting happens on a platform hosted outside the UK or EU, you have an international transfer to account for under UK GDPR, and you need a data processing agreement that names the provider as your processor.

Ask where the data goes and what the contract says, because a provider that can’t answer hasn’t thought through your obligations, which says something about the rest of the engagement.

When Automated Vulnerability Scanning is the Right Choice

None of this means automated scanning is a con. When used honestly, it’s extremely valuable.

Vulnerability scanning is the right tool for continuous monitoring between tests. Run monthly, it catches missing patches and newly disclosed weaknesses across a large estate far more cheaply than commissioning a consultant could.

Many reputable penetration testing firms, like ourselves, also use automated tooling as the first pass of a human-led test. Expert time is then spent on judgment rather than on a routine sweep that a machine can do faster and more thoroughly.

The technology isn’t the problem here; it’s the way some providers package and sell it. A scan presented and priced as a scan is a sensible purchase, so long as that’s what you want.

A scan presented as a full penetration test, at a price that quietly tells you it can’t be one, leaves you with a document that won’t withstand an insurer’s scrutiny after an incident and won’t have found the attack paths a person would.

Penetration Testing Provider Checklist: Questions to Ask Before You Sign

Here are six questions you can put to any prospective provider, and weigh the answers together to know exactly what you’re buying:

1. Who, by name, will carry out the testing, and what are their qualifications?
2. What methodology do you follow, and are you CHECK- or CREST-recognised?
3. Will we have a scoping conversation before work begins, and who from your team will be on that call?
4. Where will the test data and the final report be stored, and under which jurisdiction?
5. What does the day-rate or effort breakdown look like for this engagement?
6. How will findings be triaged, and what does the remediation support look like afterwards?

If they answer those questions plainly and confidently, you’re very likely dealing with genuine human-led testing.

If they’re met with vagueness or redirected to a platform, you’re buying an automated scan. Then you can decide whether a scan at that price is what you need, or whether you need a full, human-led penetration test.

At Fortifi Cyber Security, we believe you should know what your money buys, so when a governor or auditor asks whether the school has been properly tested, you can say yes and mean it. Contact us today for a quote on human-led penetration testing.