Every week brings new headlines about AI-powered attacks, autonomous hackers, and the next wave of cyber threats. Those risks deserve attention—but in K–12 environments, penetration tests continue to uncover a more basic problem: districts are still leaving ordinary attack paths open. Exposed credentials, excessive privileges, weak segmentation, and insecure administrative practices can give an attacker a route from a standard account to Domain Admin without any AI or sophisticated exploit.

This session examines both sides of the current AI conversation:

The Basics Attackers Still Exploit
- How testers use routine misconfigurations to move from a standard account to sensitive files, administrative tools, and credentials.
- Why attackers often do not need AI when the fundamentals are still exposed.
- Which recurring weaknesses we find across K–12 environments—and how they combine to create full-domain risk.

Where AI Creates New Concerns
- How Shadow AI—staff and students using unapproved AI tools—can move sensitive district data outside the district’s visibility and control.
- What can happen when student records, staff information, credentials, incident details, or other sensitive material are uploaded without clear rules for retention, access, reuse, or deletion.
- Why districts may struggle to determine what data was uploaded, which accounts or vendors can access it, and whether copies remain after the original user deletes them.
- How to pair practical AI-use guidance with foundational controls so the response is not just “ban the tool,” but reduce exposure while preserving legitimate productivity.

You’ll leave with a clearer view of where AI genuinely changes the risk—and where fixing the basics remains the fastest way to reduce the likelihood of a full-domain compromise.

PRESENTER: Jason Mull, Lockstep Technology Group

Cybersecurity Summit Session 4B

Cyber / Information Security

...There are no COOPs...