For schools What can be found publicly about your school
A passive assessment without any risk: we gather what is freely available online about your school – from forgotten logins to data in published files.
- The key questionWhat can someone find out about your school without touching a single system?
- Why schools in particularOver the years, project pages, test accounts and files accumulate that nobody feels responsible for any more.
- No riskCompletely passive. No load, no alarms, no maintenance window needed.
What can be found publicly about your school
- Mapping of all domains and subdomains pointing to the school
- Search for forgotten test and project systems
- Checking published PDF files for metadata and internal usernames
- Matching staff addresses against known data leaks
- Report in plain language with a clear recommendation for each finding
How it works in practice.
Mapping
Domains, certificates, reachable services – including those long forgotten.
Files
Letters to parents, forms and annual reports often carry more information than intended.
Leaks
Matching staff addresses against known data leaks.
Assessment
Which of it is a real risk, which is harmless – and what simply needs to be switched off.
The analysis of freely available sources. We gather what is already on the internet about your organisation – the way an attacker would at the start. The abbreviation stands for "Open Source Intelligence" and has nothing to do with open-source software.
At no point do we send a request to your systems. Everything comes from third parties who hold this information anyway. That is why there is no risk of outage, no alarms and no need to coordinate with your IT.
When a provider has been hacked, addresses and passwords often turn up in collections that are traded. We check whether your addresses appear there – and above all whether that is still a risk today or an old finding without consequences.
A test system or an old project page that nobody looks after any more but that can still be reached from the internet. Because nobody misses it, a break-in there goes unnoticed too.
What is included – and what explicitly is not.
Typical scope
One school site with its associated domains.
Duration
Two working days, report within one week.
Prerequisite
A written commission by the school or its maintaining body. We don't need access to systems.
Not included
No evaluation of pupil or teacher profiles on social networks.
The check shows the publicly visible side. It says nothing about security inside the school network – that is what the school network check is for.
What people ask beforehand.
No. We only examine the school as an organisation. Personal profiles of individuals are excluded – unlike in a company assessment, where the employee footprint can be part of the engagement.
Yes. We don't send a single request to your systems. Everything comes from third-party sources that hold this information anyway. That is why it is usually the most sensible starting point for schools.
Usually it produces a short list of things that can be switched off or removed – often at no cost. Your system administrator can work through the technical part directly.
More offers for you.
Awareness training for classes
Two lessons from year 5, in the class's language rather than the handbook's – with real cases the pupils know.
School network check
A technical assessment tailored to the reality at schools: limited budget, curious users with a lot of time and particularly sensitive data.
Parents' evening on digital safety
An evening for parents and guardians that is not about bans, but about what actually helps at home.
Training for teachers
In-school training that starts where teachers actually bear responsibility: grades, pupil data and their own staff account.
What can be found publicly about your school
A passive assessment without any risk: we gather what is freely available online about your school – from forgotten logins to data in published files.
What we encounter in assessments, before you encounter it.
Not a product newsletter. We write about attack paths that actually worked against Austrian businesses, authorities and schools – and what helps against them.
- About once a month, not every week
- Concrete attack paths from real assessments
- No tracking pixel, no sharing with advertisers
- Unsubscribe with one click in every email