Watch above or listen/download below.
Cybersecurity has topped CoSN’s annual State of EdTech report for at least eight consecutive years. For Jeff Carlson, Head of Education Strategy and Advocacy at Clever, that streak is not a failure of imagination — it’s an honest reflection of how hard the problem actually is.
“Even if you’ve solved one thing, there’s another thing,” Carlson said during this week’s Tech & Learning podcast conversation. “K-12 has become one of the most targeted industries for cyberattacks, and the threats keep evolving.”
Clever, which provides single sign-on and rostering services to between 75 and 80 percent of U.S. schools — both public and private — has watched that threat landscape shift in real time. What once centered on credential theft and unauthorized access has expanded to include third-party vendor vulnerabilities, with Carlson citing an eightfold increase in two years of districts worrying about attacks on vendors that then cascade into school systems. The data at risk is not just administrative: it includes student health records, special education documentation, and mental health communications.
“The biggest concern we hear from tech teams is that student data is going to be released,” said Carlson, who spent time as a special education teacher before moving into ed-tech strategy. “You’ve got health data, comments going back and forth about mental health challenges. That’s not just a technical problem.”
The arrival of AI has added a new layer of complexity. Carlson described a moment that has become familiar to many district leaders: waking up to find that an app updated overnight and now includes student-facing AI features no one vetted or approved. His advice is pointed — focus on enabling AI for educators before enabling it for students, prioritize tools built specifically for K-12 over consumer products retrofitted for classrooms, and establish clear data minimization standards that apply whether or not a vendor calls itself an AI company.
“We’re pretty quickly moving from having AI companies to just companies that are using AI,” Carlson said. “We used to have internet companies. Everybody has a website now. We can’t assume that just because somebody hasn’t told you they’re using AI that they’re not.”
For district leaders feeling overwhelmed, Carlson’s closing message was direct: take a breath, communicate openly with families and staff before a crisis forces the conversation, and treat AI governance as an ongoing dialogue rather than a policy set once and forgotten.
“The best thing you can do with fear is try to understand where it’s coming from,” he said. “And see how you can get over it one step at a time.”
