A school district in Southern Door County, Wisconsin, cut two checks worth $67,000 to a fake superintendent in November 2025, and learned on July 13 that it was an Ohio woman who had sent staff fraudulent invoices, pretending to be the district’s top administrator. Nobody caught it until the money was already gone, routed through Cash App and into cryptocurrency, and although insurance covered most of the loss, the district is now retraining its purchasing staff and locking down its email security.
It’s a small story next to the billions cybercrime costs every year. But it’s a clean one and it captures something true about how most K-12 attacks actually begin: not a sophisticated breach of the network. Just one email, written well enough that someone believed it.
Such is the problem ManagedMethods is trying to address with its new Email Threat Intelligence, an expansion of its existing Advanced Phishing product that the Colorado-based company announced on July 21.
The startup builds cybersecurity software specifically for K-12 schools, and it argues that the filters already in place are generating more flagged emails than it has time to act on. What’s missing isn’t detection; it’s context.
A workforce problem hiding behind a tech problem
Ask someone who actually runs IT for a school district what the job looks like day to day, and you rarely get a reassuring answer. Some districts are defended by a handful of people – sometimes one – who are responsible for thousands of student and staff accounts across email, learning platforms, administrative systems, and usually on a budget nowhere near what a company of comparable size would have.
A 2025 report from CIS and MS-ISAC, built on data from more than 5,000 K-12 organizations between July 2023 and December 2024, found that 82% of schools had dealt with some kind of cyber threat impact – nearly 14,000 security events, 9,300 of them confirmed. The same report noted that attackers now target human behavior at least 45% more than technical vulnerabilities.
Put plainly, the inbox is doing more damage than the firewall.
Southern Door County isn’t an outlier, either. Bozeman School District in Montana disclosed in May that a phishing campaign had quietly compromised a device on its network months before anyone noticed, exposing staff data. And when Instructure’s Canvas platform was breached that same month, districts from Arlington Public Schools in Virginia to San Diego Unified were warned that the stolen student and course data would probably resurface later, in phishing emails convincing enough to get past guardrails.
Ultimately, an attacker that knows a real teacher’s name or a real course number can write something that clears the bar a filter was never built to catch.
What counts as convincing has changed
The other half of this is what’s happening on the attacker’s side. As recently as 2024, researchers figured only a small slice of phishing emails were AI-written.
Now, however, KnowBe4’s newest Phishing Threat Trends Report found that 86% of the phishing attacks it analyzed were AI-driven, and that attackers have started moving past email into calendar invites and workplace messaging tools. Emails impersonating a colleague or supervisor, the same shape as the Southern Door County scam, showed up in 30% of the attacks the firm tracked in the first quarter of this year.
The old advice for spotting phishing was to watch for awkward phrasing, generic greetings, a sender name that didn’t quite match. None of that holds up against a message a language model wrote to sound exactly like someone’s boss.
In sum, a district’s existing filter can still catch a lot of that traffic. What it usually can’t do is tell an already-stretched IT staff which of the day’s flags actually deserve a second look.
Proactive approach: ManagedMethods
That’s the gap Email Threat Intelligence is meant to close. It sits on top of ManagedMethods’ existing Advanced Phishing engine as a new analytics layer, and the company says the underlying detection has been tuned specifically on K-12 attack patterns rather than borrowed from enterprise tools built for a very different kind of user base.
“Phishing remains the leading entry point for ransomware, account compromise, and data breaches, but simply detecting suspicious emails is no longer enough,” said Charlie Sander, CEO of ManagedMethods.
“Email Threat Intelligence gives school districts the context they need to make smarter security decisions instead of reacting one email at a time.”
Practically, that means a district gets a live read on how much phishing volume it’s dealing with and how sophisticated it’s getting, plus a sense of which staff and students are being targeted most, so that training and extra protection can go where the risk is actually sitting instead of being spread evenly across everyone.
The dashboard sorts incoming threats by type: credential harvesting, business email compromise, brand impersonation, platform abuse. It tracks activity over time, useful for catching a pattern like phishing volume spiking every August or holiday season.
There’s also a metric comparing malicious to legitimate inbound mail, which works less like a threat feed and more like a gut check on whether existing defenses are pulling their weight. When something does need a closer look, the dashboard surfaces the most-targeted users, flagged senders, and daily trends up front, rather than leaving staff to reconstruct all of that by hand.
“Our goal has always been to bring sophisticated cybersecurity capabilities within reach of every school district. Email Threat Intelligence reflects that vision by giving K-12 IT teams the AI-powered email security toolkit they need to better protect students, staff, and district data,” Sander added.
The bigger bet
None of this makes phishing disappear. ManagedMethods’ bet is narrower: districts aren’t losing money and data because nothing catches the bad email. They’re losing it because nobody has time to triage the hundreds that get flagged.
Comparitech’s latest count put ransomware attacks against the broader education sector at 251 confirmed incidents worldwide in 2025, with close to 4 million records breached, up 27% from the year before. Trace most of those back far enough and you land on one email somebody believed.
Whether a dashboard actually changes that for the smallest, most stretched-thin districts is something that gets proven over time. But as AI keeps narrowing the gap between a real email and a good fake, the districts that get burned probably won’t be the ones without a spam filter. They’ll be the ones with no way to tell, quickly, which of the thousand flagged messages this week actually needed a person to look twice.
More information on Email Threat Intelligence is available at managedmethods.com.
Featured image: Clint Patterson via Unsplash+
Disclosure: This article includes a client of an Espacio portfolio company.
