One Year of Free Cyber Protection for Small U.S. School Districts

August 8, 2024, marks the first anniversary of Project Cybersafe Schools, Cloudflare’s initiative to provide free Zero Trust cybersecurity tools to eligible small K-12 public school districts in the United States. The program was announced at the White House on August 8, 2023, during the Back to School Safely: K-12 Cybersecurity Summit hosted by First Lady Dr. Jill Biden.

Cloudflare’s broader mission of building a better Internet includes supporting organizations that are especially vulnerable to cyber threats but lack the resources to defend themselves. Project Cybersafe Schools joins other efforts like Project Galileo, the Athenian Project, the Critical Infrastructure Defense Project, and Project Safekeeping in this aim.

Why Schools Need the Help

The threat landscape for educational institutions is severe. In Q2 2024, education ranked fourth on the list of most attacked industries. Between 2016 and 2022, there were 1,619 reported K-12 cyber incidents across the country. Since Project Cybersafe Schools launched in August 2023, several high-profile attacks have hit schools:

  • In August 2023, Prince George’s County Public Schools in Maryland suffered a ransomware attack that exposed personal data of more than 100,000 people.
  • In December 2023, a Cincinnati-area school district lost $1.7 million to a cyber attack.
  • Throughout 2024, incidents have been reported in Massachusetts, New Jersey, and Washington state.

Small districts are often the most exposed. Many lack dedicated cybersecurity staff—the person handling security often does so alongside a primary role as a teacher, coach, or administrator. This is a core reason Cloudflare launched the program after conversations with CISA, the Department of Education, and the White House. As Kemba Walden, then Acting National Cyber Director, said at the National Cybersecurity Strategy launch in March 2023: "we expect school districts to go toe-to-toe with transnational criminal organizations largely by themselves. This isn't just unfair; it's ineffective."

Program Impact and Adoption

There are roughly 14,000 school districts in the United States, and about 9,800 of them have fewer than 2,500 students—all of which are eligible for the program at no cost and with no time limit. In its first year, Project Cybersafe Schools has onboarded nearly 120 qualifying districts across nearly 30 states, representing every region of the country. This protects more than 160,000 students, teachers, and staff.

That number is still not enough, Cloudflare says. When it published an update in December 2023 encouraging districts to sign up before the holiday break, inquiries from eligible districts noticeably increased. The company is pushing to get the word out further.

Attacks Blocked in the Program’s First Year

In 2024 alone, Cloudflare’s cloud email security has identified and blocked more than 2 million malicious emails targeting enrolled districts—roughly 3.5% of their total email traffic. In one district, malicious emails blocked by Cloudflare represented more than 15% of all email traffic.

Spam is also a significant problem. Project Cybersafe Schools has prevented more than 2.2 million spam emails from hitting inboxes. While much of this spam is promotional and not overtly malicious, it is often used as a vector for attacks. Given that more than 90% of all cyber attacks begin with a phishing email, securing inboxes is a critical step in reducing overall risk. The consequences of a successful attack are steep: recovery can take anywhere from two to nine months, nearly an entire school year.

What Participants Say

“What Cloudflare's Project Cybersafe Schools has allowed us to do as a rural district is add a missing layer of protection to our devices, providing a previously missing and unique layer of security even off our secure network. Where other options would cost us somewhere in the thousands, we are now able to secure devices for free using one of the simplest and scalable platforms, featuring one of the easiest learning curves I've worked with.” — Wyatt Determan, Technology Specialist, HLWW Public School District, Minnesota

“Since implementing the Cybersafe Schools program as our secure email gateway, we've saved over $5,000 per year compared to similar solutions. The program has effectively filtered out numerous malicious emails, greatly enhancing our security posture. Its seamless integration and user-friendly interface make it easy for our IT team to manage.” — Paul Strout, Network Manager, Regional School Unit RSU71, Belfast, Maine

Services and Eligibility

Eligible K-12 public school districts in the United States can access a package of enterprise-level Zero Trust cybersecurity services at no cost and with no time limit. There is no catch and no underlying obligations. The package includes:

  • Email Protection: Safeguards inboxes with cloud email security against malware-less Business Email Compromise, multichannel phishing, credential harvesting, and other targeted attacks.
  • DNS Filtering: Protects against Internet threats by preventing users from reaching unwanted or harmful online content like ransomware or phishing sites, and can be deployed to comply with the Children’s Internet Protection Act (CIPA).

To qualify, a district must be a K-12 public school district located in the United States with up to 2,500 students. Schools that do not qualify can explore Cloudflare’s other packages with educational pricing by contacting [email protected].