Email security for schools
Stop phishing, impersonation and payment fraud before they reach staff inboxes. Powered by Mesh, managed by our team and available as a standalone service.
Why email security matters for schools
Email is the easiest way into a school. The government’s Cyber Security Breaches Survey consistently finds that phishing is the most common type of attack schools report. A single convincing email can be all it takes for an attacker to get in.
Schools are an attractive target. Staff handle sensitive pupil data, pay suppliers, and are busy, so a well-timed email can slip through. Common attacks include:
- Phishing: fake Microsoft 365 or Google sign-in pages that steal staff passwords
- Impersonation: emails pretending to come from the headteacher, a governor or the trust, asking for urgent favours or gift cards
- Payment fraud: fake invoices or “change of bank details” requests from what looks like a known supplier
- Malware and ransomware: harmful links and attachments that can lock up school systems and data
- Compromised accounts: real email accounts at other schools or suppliers that have been hacked and are used to send convincing scams
We’ve seen this first-hand. Read our post on hackers impersonating headteachers using real email accounts.
The built-in filter isn’t always enough
Microsoft 365 and Google Workspace include basic spam filtering, but targeted attacks such as impersonation and invoice fraud often contain no virus or dodgy link at all. They need a tool that looks at who the email is really from and how it’s worded.
How Mesh protects your school
We use Mesh, a specialist email security platform built for managed service providers, now part of Bitdefender. It works with Microsoft 365 and Google Workspace and checks every incoming email before it reaches staff.
Phishing protection
Suspicious links and fake sign-in pages are caught before staff can click them.
Impersonation detection
Spots emails pretending to be your headteacher, trust leaders or familiar suppliers.
Payment fraud protection
Helps stop fake invoices and bank detail change requests that target your finance team.
Warning banners
Clear warnings on emails that need a second look, such as messages from outside the school.
Malware and ransomware
Harmful attachments and links are stopped before they can do damage.
Managed by our team
We set up the policies, review what’s being caught and release genuine emails if needed.
A standalone service
You don’t need to be an IT support customer to protect your school’s email. Our email security is available on its own, whoever looks after the rest of your IT. We set it up, configure it for your school and manage it for you.
It also fits alongside our other services. Combine it with Microsoft 365 backup so that if something does get through, your email and files can be recovered, and with school IT support for complete cover.
Supporting the DfE cyber security standards
The DfE’s cyber security standards for schools and colleges expect schools to protect against malware and phishing and to train staff to spot threats. Email security is one of the most effective steps you can take towards them.
Getting started
Free review
We look at how your email is currently protected and where the gaps are.
Set up and configure
We connect Mesh to your Microsoft 365 or Google Workspace and tailor the policies to your school.
Ongoing management
We monitor what’s being caught, fine-tune the settings and help staff if they’re unsure about an email.
Email security FAQs
Doesn’t Microsoft 365 or Google already filter our email?
They include basic spam and malware filtering, but targeted attacks like impersonation and invoice fraud often get through because they contain no malicious link or attachment. Mesh adds a specialist layer that looks for these threats.
Can we have email security without your IT support?
Yes. Email security is available as a standalone service, whoever provides the rest of your IT.
Does it work with Google Workspace as well as Microsoft 365?
Yes. Mesh works with both Microsoft 365 and Google Workspace.
What happens to an email that’s blocked?
Threats are quarantined or flagged with a warning banner. If a genuine email is caught, we can review and release it.
Will staff notice any difference?
Mostly, they’ll just see fewer scam emails. Some emails will carry a warning banner so staff know to take extra care.
Do you cover schools outside Leeds?
Yes. We protect schools and trusts across West Yorkshire, and because email security is cloud-based we can support schools further afield too.
Let’s talk about your school
To contact us with any enquiries, please fill in the contact form.