001Um, except we have a a lot of content to cover. So, good morning. This is the Cybersecurity Coordinator Forum for April 2026. Uh, just a little bit of housekeeping. Um, the webinar is being recorded. Uh, actually, let me make sure that it's being recorded. Yep. Recording and slides will be available a few days after the webinar ends at the TA Cybersecurity website. Uh, chat has been turned off. Uh, so if you have any questions, please submit them uh, in Q&A and we'll address them at the end of this uh, session if there's time or we'll follow up by email. Uh, duplicate logins are not allowed. Uh, and please uh, chat bots are not allowed either. So, if if you're in here with a chat bot, please remove it. Uh, the team will be working uh,
002if they see them to also remove them as well, but I appreciate everybody just keeps them off whenever you join these sessions. Excuse me. So, um, today we're going to hear from uh, various um, security um, office team members. Uh, and so um, I'm leading the show, but we will be hearing from from the different folks. And I wanted to kind of review all I always like to give kudos to the entire team. A lot of the security operations stuff happens uh, not not by just a few individuals, but a but a large team. Uh, and so we have uh, in the team Julia uh, who is the executive director, IT mission and compliance. Laura, who is the DCS contract manager and K-12 cybersecurity project lead. Susan, who is the cybersecurity governance, risk, and compliance
003analyst. Desiree, who is not able to be with us here today, uh, but is also a cybersecurity governance, risk, and compliance analyst. Uh, and then of course for the security operations team, we have Sam uh, who is the cybersecurity operations manager and Miles, who is the cybersecurity operations associate. So, these are the folks that uh, do various things uh, at securing the agency and of course helping uh, in in the K-12 initiative um, because it's it's a team work, guys. It's there's there's a lot of moving parts scenes and I'm very grateful for for the work of the entire team. Excuse me. Um, just as a reminder for the folks that may be new to the show, the TA Cybersecurity team hosts a monthly meeting for Texas school systems, cybersecurity coordinators, technology coordinators, uh, for
004for the education service centers, uh, and cybersecurity personnel, and any other members of the community that support K-12 cybersecurity efforts in Texas. It provides content designed to assist school systems and ESCs towards maturity in an information security program. So, the agenda for today, I will be uh, I did introductions and housekeeping. Uh, Susan will be doing the legislative updates. Miles uh, and Sam will uh, review some of the cybersecurity advisories. Uh, and then I will continue with an update on the K-12 cybersecurity initiative, uh, mention some upcoming events, and then we'll do a wrap-up. So, it's it's a it's a short sweet agenda, but there's plenty of content, so I think we're going to be here the the the full hour. So, Susan, legislative updates. Good morning, everyone. Uh, let's see. You can advance the
005slide, please. So, the upcoming 90th legislative legislation is going to have their pre-filings on November 9th at the fall of this year. And then on January 12th, the House and Senate will convene. And so, their last day to file is March 12th to file all their bills. And then sine die will be May 31st when the session is over. And then um, shortly after that we'll get to see what has passed. And one of the focuses they're going to have for for the 90th legislative session will be AI and data privacy. So, those are confirmed to be in this upcoming session. And so, that the House interim committee um, which was released in March 2026, they've prioritized um, artificial intelligence-related technologies, data centers, and advanced computing infrastructure. So, this this signals um, likely new legislation
006and amendments to the Texas Responsible Artificial Intelligence Government Governance Act and the Texas Data Privacy and Security Act. They're going to focus on governance, deployment limits, and oversight of emerging technologies. So, this means that um, their their policy road map for the bills that are going to be filed in January 2027 is that they're going to focus on AI and data privacy. So, it's no longer exploratory exploratory. They're now going to be part of the House's former formal technology oversight. And um, as this is starting to move through, TA will not be TA will be monitoring guidance that may emerge from the 90th legislative sessions, but we won't issue guidance in advance of the session. So, if we have have any questions before anything passes or the before the session ends, we won't be offering
007any guidance. Next slide, please. So, per Texas Government Code 2054. um, covers the annual cybersecurity awareness training, which must be certified by DIR by August 31st. So, this is for K-12 cybersecurity coordinators and elected officials only. Uh, of course, schools um, can you know, offer training to more staff, but per the government code, it just applies to the cybersecurity coordinator and elected officials. Also, HB 3512 89R added an annual AI awareness training requirement. And that also has the same due date of being certified on August 31st that the appropriate personnel has taken the AI awareness training. So, this will be in another annual training separate from the cybersecurity awareness training that's due annually. Next slide. And per Government Code Section 2054.5193B, it states that the artificial intelligence training program that is um, mandatory annually should
008focus on forming an understanding of how artificial intelligence technology may be used in relation to a state employee's responsibility and duties, and also teach best practices on literacy in deploying and operating the artificial intelligence intelligence technologies. Um, we're seeing an emergence of you know, a lot of um, AI misuse or not understanding on um, verifying your results if you're using you know, generative AI. So, this is becoming important to address. Next slide, please. So, for school systems, like I mentioned before, only cybersecurity coordinators are required to complete the annual AI training. Um, and the elected officials are subject to the local government training requirements. So, each school would need to uh, verify that themselves. And any other school system employee as determined by school systems and the cybersecurity coordinator may um, be asked to take
009the training, but that is up to each individual school system. For state agencies and local governments, employees who use a computer at least 25% of the year their required duties are required to take the annual AI awareness training. If that agency has elected or appointed officers and officials, they will also be required to take the training. But um, different what's different from the cybersecurity awareness training is the state agency contractors will not be required to complete AI training as per the new legislative code. Um, it's not required, but you you can always implement it as your own agency's policy. So, just wanted to put that out there, but they're not uh, contractors are not required at this time to complete the AI training. Next slide, please. So, currently um, DIR has several AI trainings that
010are um, available at the link provided there. And right now they have 16 certified vendors that are providing AI awareness training. 14 require registration fee and two do do not. They're available at no cost. For public sector provided training, there are 10 that are certified. Two require registration fee and eight eight do not. Uh, DIR DIR also has a 32-minute AI awareness training video, a Texas AI awareness, I believe it's called. It's a YouTube video. And that's able to be utilized. However, it offers no tracking or um, a certificate of completion. So, you would have to if you're going to use that, you would have to um, figure out how you would be in compliance with any auditing of the training or um, providing completion of your staff. Um, again, this is due by August
01131st, 2026. So, you would be reporting to DIR that you have compliance in this uh, train AI training. And then you would want to keep record of completion for your audits. Awesome. And and to give Susan a little bit of of kudos, uh she was able to using our current platform figure out how to integrate the free DIR training video uh into the platform along with tracking uh so that we could use that at least for this year um as our uh AI training for for the agency. And I believe that is my last slide. So, thank you all. Yes. Sam, Sam will be leading our cybersecurity advisories. All righty, thank you Daniel and Susan. Yeah, I'm going to take over the cybersecurity advisories and we can get straight into it. Um we're going to
012start off with some trends we've seen uh coming up over the last year. Um to no surprise, we've seen about an 89% increase in AI-enabled and based attacks. Uh I think this is only going to get stronger as AI is is is just an evolving technology and it doesn't seem like it's really going anywhere. Um and it's being used in more and more different vectors. So, uh that's that's going to be something to keep an eye out for and make sure your your training is up to date on. Uh we're going to talk a little bit more about that later. Um this has also caused a drastic decrease in breakout time to just 29 minutes. Uh if you don't know what breakout time is, that's essentially the time from when an attacker first, you know,
013gets into your environment to where they are able to spread their access or elevate their, you know, elevate their permissions. Uh this is uh a 65% decrease from 2024. Uh and in the in the included report here, the source report, uh this line is basically a a direct line down. So, I think we're going to see this only get faster, especially as as AI gets stronger as as a, you know, as a an offensive tool. Um malware has started to be seen less. Uh it's only been used in about 18% of attacks uh in 2025. I think that the main reason for this is malware is just not as useful as some other attacks. You know, it's not profitable for organized crime. Uh ransomware is you know, you want they usually want money and stuff
014and I think really the 18% is probably going to be more related to like info stealer stuff. Um so yeah, it's it's a it's a vector that's not ever really going to go away, but I it definitely makes sense why it's on the decrease. Uh additionally, we've started to see uh a lot new organized crime uh groups pop up. We've seen 24 new ones pop up over the last year um that have been acknowledged by cybersecurity firms uh CrowdStrike and such. I believe the main one or a good example would be Fancy Bear, which is a Russian-based threat actor. Um and again, because we've seen a lot of these, I think this is going to be one where we're just we're going to see a lot more organized cybercrime pop up and especially with uh
015AI being a tool, it's easier than ever to stand up you know, new attacks and such. Uh additionally, again, probably related to AI is going to be a 42% increase in zero-day attacks that have been exploited before public disclosure. Um zero-days are pretty scary because again, you can't really do much to guard against them. Um so, it's going to be more imperative than ever to have good detections in place in case you are hit with a zero-day attack. And again, AI is getting increasingly good at building its own uh exploits and stuff. So, uh this is going to be a major one that's coming up over the next couple years is uh you know, protecting against zero-days and being able to detect those as they come up. Uh lastly and unshockingly is account compromise is
016on the rise and has seen a 36% increase. Uh I think this number will only get stronger as well. Uh you can targeting users is essentially a foolproof way of of compromising a system or a or a, you know, an agency or something. Uh you can't really patch users, you can only train them. So, uh again, as as fishing gets more advanced and such, uh that that's only going to get get worse. So, keeping your users trained is is is also very imperative. If we want to move on to the next slide, we can do some advisories as well. All righty. And so, our for our first advisory here, um the current Iranian conflict is still ongoing. Uh at the time of making these slides, I'd kind of hoped that this would have been something
017that was resolved and we could, you know, you know, put a pin in it for a little bit and they're resolving stuff, but unfortunately, it's kind of gone back and forth as to will they, won't they as to if this is going to get fixed. Um so, we're still seeing Iranian-based uh APTs, advanced persistent threats being increasingly active. Um uh the attacks aren't necessarily targeted at lower-level uh US infrastructure. They're mainly targeting government agencies and such. But it's still good to keep caution, you know, you never know when when when threat actors might change up their strategies or, you know, it doesn't stop them from disrupting other areas of of infrastructure. Um so, having uh advanced detection and block rules in place for Iranian-based traffic is going to be pretty uh pretty imperative while this
018persists. Uh additionally, this is could go for anything in the in the Middle East or anything outside of the US really uh is is is good practice, especially if you're not expecting that traffic. Uh additionally, if you have any people or colleagues or whatever that are traveling overseas, uh additionally, some or occasionally some flights may be uh rerouted that are going through this area. So, it's worth noting that, you know, take extra uh precautions while traveling. And then we can go on to the next slide. Uh secondly, we have an an uh an Adobe product vulnerability. Uh I think this is a month or two ago. Uh essentially, the entirety of the Adobe suite uh got hit with a couple vulnerabilities. Um the ones listed under the affected following products here uh were hit with
019a remote code execution, which is obviously a very severe vulnerability that we don't want to be just allowing to float around in our environment. Um so yeah, it's recommended currently to update all Adobe products to the most recent and stable patch. Um thankfully with Adobe, uh it there's not a lot that relies on it. So, updating it shouldn't break anything and it should be a pretty easy patch. And again, I think you can patch the whole suite almost at once with with Adobe's tools. So, uh keeping that up to date is going to be good. And again, you don't want a remote code execution floating around in your in your environment. So, next slide. All right. And lastly, we're going to kind of go into detail on some of these AI-enabled threats. Um some stuff
020that you really want to watch out for, some stuff that you may, you know, want to just keep a keep a pin in or do some extra research in. So, the first one's really going to be related to social engineering. Again, you can't patch users, you can only train them. Uh and this is allowed threat actors to do various different things in the fishing environment. Uh they're able to stand up increasingly complex social engineering attacks um by creating like full-on web infrastructure that like mimics like sign-on pages one to one. Uh recently, I think last month it was, there was like a like a Teams invite uh fishing attack where if a user had clicked on it, it would take them to like an invite page and it was like one to one with the
021Microsoft page other than it was like a fake fishing attack. So, um and like again, this can be stood up in like very very quickly with AI. So, that's that's something that to keep an eye out at and it's becoming more dangerous. Um obviously, keep them up to date on fishing training and, you know, make sure they're fishing resistant. Uh information operations is is kind of a fun one or not a fun one depending on how you are. Uh it's really different for disinformation operations. Uh AI has uh gotten insanely good at creating fake videos, images, articles, all that stuff that can spread disinformation. Uh and it's becoming very very hard to tell the difference between a legitimate image and an AI-generated image. Um so because of this, it's it's more imperative than ever to
022really have uh trusted sources for information. It it it, you know, gone are the days when you're able to just kind of go pull information out of the wild and be like, "Hey look, this is kind of cool." because now, you know, no if it's if it's like an AI or a deep fake or something. So, uh again, having trusted and verified sources for your information is going to be really good before you start, you know, spreading something that you don't know if it's truthful or not. Uh and then lastly and probably the most dangerous and probably the most relevant one today is going to be the technical operations. Um threat actors have begun using AI to write malicious code and exploits. Uh this has really been seen uh in the news recently with I
023think it's Anthropic is building it's called Mythos, which is a AI-based uh penetration testing platform or AI, I guess, directly than I even really a platform. Um and it's allowing it allows the AI to fully write an exploit code. Um it's it's very very good. Um apparently, it's very very good at it. And it's able to do like full-on vulnerability like testing and penetration testing. And unfortunately, in the last like week or two, they've seen like multiple attacks with uh external people uh getting access to this technology early um when they were not supposed to. And they haven't released uh as far as I know as if it was a malicious actor or if it was just people who were curious. Um but my guess would be malicious actors. So, this is going to be
024something that we're going to really want to keep an eye on um as well as stay on top of vulnerability management and patch management because as soon as threat actors have the ability to use AI to, you know, fully exploit anything in your environment, uh it's like, you know, wildfire. So, yeah, that's going to be a a very very big one uh to keep an eye on and keep it researched on. And again, uh vulnerability management and patch management is going to be more critical than ever, especially in this upcoming years as that technology uh you know, becomes more developed. And then we can go to the next slide. And I think that's all I have and I can toss it over to Miles. Yep, thank you, Sam. Miles will be leading our emergent threats.
025Thank you, Sam. Uh next slide, please. So, continuing with emergences emerging threats, a recently discovered Mac OS stealer campaign has emerged. Uh CIS has identified an active and evolving Mac OS info stealer campaign known as Mac 6 stealer. It specifically targets state, local, tribal, and territorial orgs. Mac Stealer is discovered as malware as a service and is designed to steal sensitive data at scale. Threat actors use ClickFix specifically for social engineering, SEO poisoning, and fake capture pages to lure users in. Victims are tricked into copying and pasting malicious commands into terminal, allowing execution without traditional malware downloads. In 2026, the campaign shifted away from detectable binaries, making it harder to identify with legacy Mac OS security tools. So, current techniques include shell-based loaders, Apple script execution via trusted Mac OS components, and fully in-memory execution,
026leaving minimal forensic artifacts. These methods enable attackers to bypass standard Mac OS security controls and persist undetected. Next slide, please. This campaign represents a high-impact business threat due to its ability to steal credentials and active session tokens, which enables follow-on compromise. Stolen access leads to downstream intrusion across email environments, VPNs, cloud services, and internal systems, significantly expanding the blast radius. The threat is Mac OS focused, targeting a platform often viewed as lower risk and therefore less actively monitored in many environments, and initial access is human enabled, relying on normal user actions rather than software exploits, which reduces the effectiveness of technical controls by themselves. And the data targeted by this malware includes browser credentials and active session data, Mac OS keychain contents, cloud credentials, which includes AWS, uh Kubernetes, and SSH keys, as well as
027sensitive local files such as PDFs, encryption keys, and VPN configurations. And lastly, cryptocurrency wallets is also included. So, this includes persistent backdooring of Ledger hardware wallets specifically. Next slide, please. So, how the attack works at a high-level overview, the attack begins with malicious search engine results, where threat actors manipulate SEO to surface fake but legitimate-looking websites. Then, users searching for common content like ebooks, software tools, or technical guidance are then unknowingly redirected to attacker-controlled sites. Once on the site, victims encounter a fake capture page that leverages the ClickFix social engineering technique, and users are then instructed to copy and paste a command into the Mac OS terminal, believing it's required to continue. Because the user executes that command themselves, this method bypasses traditional malware download warnings and security prompts. So, after it's been executed, the
028malware operates silently in the background and steals the sensitive data mentioned in the previous slide. And once that stolen information is exfiltrated and local artifacts are removed to hinder detection response, we've seen in more advanced cases, the campaign introduces long-term persistence risks, particularly involving cryptocurrency wallets. The malware can modify installed wallet applications, enabling ongoing credential theft even after the primary malware is removed. Next slide, please. When it comes to mitigation, CIS strongly recommends targeted user awareness training with specific emphasis on ClickFix and fake capture-based attacks, which exploit normal user behavior rather than software flaws. Organizations should implement DNS level blocking of known malicious domains, such as through MDBR to disrupt access early in the attack chain. Deploying endpoint detection response solutions is also recommended because it targets script execution visibility and controls. It's This is
029critical given the malware's fileless and in-memory nature. Uh Moving on, the strict application of allow listing is also suggested, as this can significantly limit the ability for unauthorized scripts or abuse system tools to execute. Limiting full disk access on Mac OS also reduces the malware's ability to read sensitive credentials and user data. And keeping Mac OS fully up to date is essential, as newer versions introduce additional protections, including terminal paste warnings that help interrupt ClickFix attacks. So, CIS recommends subscribing to the Multi-State Information Sharing and Analysis Center indicator sharing to stay current on emerging indicators and campaign activity. And lastly, CIS assesses that it's highly likely this attack will persist throughout 2026 due to its speed, scalability, and low cost to threat actors. Next slide, please. Miles, real quick. So, so this is interesting. Seems
030like Mac is being targeted by by this Mac Stealer. So, it's it's a good note for folks that have always mistakenly believed that Mac is not as susceptible to Windows systems, but Mac can definitely fall victim to malicious software such as this. And so, that protection of "Nah, I don't know what happened to a Mac" should not continue, and the EDR software that that are deployed should also cover everybody's Mac infrastructure as well. Thank you for sharing that. Yep, exactly. Thank you, Danny. >> [gasps] >> Now, switching gears to Microsoft, Texas DRR has highlighted the re-emergence of a critical Microsoft Exchange Server vulnerability, originally identified in 2023. This vulnerability enables remote code execution, allowing attackers to execute arbitrary code on vulnerable Exchange servers. So, recent threat analysis indicates this flaw is again being actively leveraged,
031particularly within Exchange exploitation techniques. The vulnerability is associated with ProxyNotShell-style attack chains, which combine multiple weaknesses to gain system-level access. Re-emergence suggests that attackers are re-scanning and targeting unpatched or poorly maintained Exchange servers, especially those still exposed to the internet. The impacted Exchange versions include Microsoft Exchange Server versions 2013, 2016, and 2019, specifically cumulative updates 11, 12, and 23. Next slide, please. When it comes to impact, this vulnerability allows an an authenticated attacker to execute arbitrary code on the vulnerable Exchange server. So, exploitation is achieved through through specially crafted requests that abuse insecure deserialization within the Exchange application. And successful exploitation results in full server compromise, which enables attackers to run malicious code, establish persistence, or move laterally within the environment. For mitigation, the patches that are available were released by Microsoft security updates, specifically
032addressing this CVE. So, organizations should review the Microsoft CVE advisory and apply the appropriate update for their Exchange server version. The updates remediate the issue by implementing proper input validation and sanitization of serialized data, closing the deserialization attack vector. Immediate action is recommended, as orgs should evaluate uh their own environments for affected Exchange servers and prioritize remediation in order to reduce this exposure. And that is the last of my slides, Daniel. Back to you. Thank you. Yes, sir. Thank you. And team, for the Microsoft Exchange, I think if you still have on-prem Exchange servers, even if they're in a hybrid, you need to move most of your access to the servers to Microsoft 365 and leave the Exchange server for internal access only to heavily help in the mitigation of this as well. All right.
033Um continuing on with with our incident trends, one of the things that we kind of keep an eye on is are the incidents that are reported by the various school systems to DIR as part of the reporting requirements on issues affecting the schools, right? And so, I asked the team to to kind of look at the last set of incidents that have been reported, and as you can see here from the list, almost all of these recent incidents have shifted typically from from from ransomware events and malicious um you you software being placed on on systems to email phishing, which is uh causing a lot of a lot of problems, right? So, we we continue to see stuff that is born in email uh making it into our our inboxes and and folks clicking on
034things uh and beginning to to wreak havoc. So, a lot of the recent incidents uh have been linked to you know, threats that come through our our inbox. Uh and so, this is something that we've been looking at and this is something that we want to change uh to reduce uh this equally with the other uh threats that have been reduced through the deployment of the EDR solution uh across the state to our schools. And that's a good segue to our K-12 cybersecurity initiative. So, just as a a recap, in 2023 uh TEA launched the K-12 cybersecurity initiative in response to the increasing threat of ransomware and other malicious cyber activity targeting school systems across Texas. The initiative was made possible through funding approved by the 88th Texas Legislature and continued in the 89th session,
035which continued TEA's request for dedicated cybersecurity resources to help systems strengthen their defenses and respond to emergency emerging cyber risks. The goal of the initiative is to deliver immediate practical solutions to help school systems defend against major cyber incidents such as ransomware attacks. Priority is given to high-need school systems. Cybersecurity practitioners are made available through regional education service centers to support the implementation of cybersecurity controls aligned within the scope of the initiative. So, that's a in a nutshell what the initiative attempts to do for all of our Texas school systems. So, uh again, a summary of our current program participation, there are currently 542 school systems that have signed a DIR interlocal agreement form, which is how uh schools can begin to participate uh with some of the services uh in the initiative. Uh endpoint
036protection being the primary um request uh through the program, 391 school systems have signed up for EDR. Uh EDR is installed on 316,500 endpoints. Uh we have to date approximately 51,000 attacks that have been blocked and at least 17,000 of those uh have been ransomware threats that were neutralized. Had the software not been in place, uh the story that we would tell today would probably be very different. Um the other request uh that has seen an uptick in request, which which I'm very happy to see, are the Texas cybersecurity framework assessments. Uh 71 schools have signed up for the assessments to date. Uh 52 have already been completed. Uh individual results from the assessments are kept confidential and this is a strong uh note that I'd like to make to the schools to say that
037this isn't meant to be a tool that allows the school systems to know where their gaps are in their security program. It's not meant to be a tool that somehow it's going to get back to uh TEA uh and and and gain any type of of reprimand or anything from us to the schools. But we want the schools to be aware of where their gaps are so they can uh mature their security program and and the information that is shared between the school and the provider, which is SAIC in this case, uh is kept confidential. At the end of the assessment, uh the information uh is not shared with uh TEA. Um and the only thing that we get is an aggregate of all the schools. So, I could tell you that across all 52
038schools that have completed what the average scores are across the schools, but I couldn't tell you specifically what the score of anyone anyone's school is. That's That's not the purpose of the assessment. >> [clears throat] >> The other request is the network detection and response pilot. Uh and as we mentioned before, uh that that uh NDR pilot is currently uh off for any additional folks. Um and we are still searching. I think we're closer now to finding a replacement for the current NDR pilot program uh that hopefully allows us to make it available to other schools. So, we got an update on current uh participation for all of the initiative items that are part of the K-12 uh cybersecurity initiative. Uh for our MFA, there are 702 school systems that had indicated interest uh and
039319 or 45% of those schools have since implemented MFA. We are working hard to encourage more schools to do so as protecting your access management and and and authorization into your systems cannot be done successfully without some form of MFA uh enabled. It highly reduces the risk of attacks of of comp compromises and things like that. Um email security protocols um specifically DMARC compliance, uh 784 school systems had indicated interest uh and and assistance in 2024. To date, uh from the reports we've received, 167 or 21% of those school systems have since implemented uh email security protocols. Um the I'm hoping that these numbers increase uh because the next thing that we're going to talk about is the email security platform that we're going to make available. Uh and this is going to be one
040of those requirements where a school either has to already be compliant uh with with DMARC or uh be compliant uh as part of the implementation uh team of that. So, we definitely uh are going to expect to see higher numbers of participation uh in DMARC compliance, which would heavily reduce uh spoofing attacks on on schools and and misuse of school domains. And then of course, we have uh limited local administrator access. 684 school systems indicated interest uh and implementation assistance. 202 or 29% of those school systems have since implemented uh local I mean, sorry, limited local administrator. All of this work has been done either by the school systems themselves, which I'm very proud of the schools that have undergone the test to do these things, or with assistance from uh the ESCs. Uh so,
041there's a lot of work being done to increase the security maturity of all of our schools across Texas. There's a lot of work still to be done, but I applaud those schools that have taken uh these recommendations and run with them uh either on their own or s- uh s- asked for guidance on on how to do this and received that assistance from from their regional ESCs. So, thank you for all the folks that are doing the the hard work to get these things done. So, new services that are being added at no cost to schools. So, I think these are some of the questions that we have received over the last couple of weeks, probably months now, as to what's going to change for this next biennium. Uh the new biennium starts on May
042the 1st. Uh and so, here are a rollout of all of the new services that will be available uh and when they'll be made available. So, cloud email security, uh this is going to be provided in collaboration with UTR SOC. Uh it'll be available starting May the 1st. Um we will speak a little bit about how the service how you can request it here in a second. Uh security awareness training and efficiency relations uh will be provided in collaboration with TASSY, the Technology Alliance for Statewide Initiatives. Uh ESCs will send sign-up info to schools starting May 13th. Microsoft 365 and Google Workspace hardening guides under development by TASSY. The ESCs will send program information and sign-up information to schools starting June the 1st. And of course, software deployment solutions uh for rollout of EDR agents
043and other software, which again was also provided in collaboration with TASSY, will be available starting September 1st. Excuse me. Um the the email security service um let's dig deep a little bit into this because this has been one of those hot topics that schools have been asking a lot of questions on. So, the email security service will be available May 1st. The partnership is with UTR SOC using their existing email security service, which is Abnormal AI. Uh this is at no cost to schools. All schools are eligible. Now, how to get started in the program is you must complete an interest and pre-registration survey. The survey was sent to all superintendents, technology directors, and cybersecurity coordinators as listed in AskTed on um April 21st. So, if if you've not received those, uh you can you
044can uh look look first in your your junk folders. A few schools that reached out to us already says, "Hey, we didn't see this." Found the the the uh link in their junk folders. If not, you can reach out to to the team uh and we can make sure that you find the the the registration link so that you can complete that. Uh some of the questions that we have received is if this There are a few schools that were customers of the UTR SOC prior to this who already had the Abnormal AI service. A lot of those have asked, "Hey, do we have to have to do the survey?" The answer is yes. We would appreciate One of the options in there is is to say that you already have the service uh through
045the R SOC and this helps to make sure when we're sort of counting all of our beans to make sure that we communicated with all the schools. Otherwise, we're going to If we don't see them in in the in the survey responses, then we're going to reach out to you and say, "Hey, do you want this?" You're going to tell me no. Uh and so, this helps the team to to cut through that. If you do have the service, please uh complete the the survey anyways. For schools that are not interested in the service, this is how you let us know that you're not interested in the service so that we don't later on ask questions about, "Hey, do you want the service?" etc. and so forth. Uh uh completion of the survey will allow
046us to put you on the not interested list. Uh and that's fine. Uh but it definitely helps because like I said, we we want to make sure that we communicate this to all of the um school um systems in Texas, which is a big task. So, you all can help us by even if you're not interested or already have a service, that you still complete the survey to let us know. The purpose uh of interest in and the survey, if your school is interested we want to know how many licenses you may need and your target implementation time frame. So we are going to use the survey as sort of the queue of when we can make it available to those schools. So the only way to get the service at the beginning now in
047the initial is completion of the survey. Once we receive the survey responses, we will line up the schools based on when they can start and the uptick that the RSOC is able to handle as the licenses are as I'm sorry as all the school systems are on boarded on in use of those licenses. So letting us know if you have a tool already in place, if you're currently in a contract or when you can start is very helpful so that we know when we can queue you up. If your school again if it's not interested, we want to know that too. This is our way of verifying that your school is aware of the program and are not interested so that we don't have to then go back and reach out to you at some
048later point just to get that confirmation. So you will very much help us out if you complete the survey anyways even if you're not interested in in the software. I would much appreciate that. So the little bit of on the security service and the benefits, it is AI driven email protection that detects threats that traditional tools often miss such as executive impersonation, vendor invoice scams and phishing attempts with no links or attachments. So as I said, one of the biggest incidents that we keep getting reported to DIR are email phishing uh attacks and other things like that that are coming through email and this tool will help to uh reduce the risk of that for the service. TEA uses the the Abnormal product and I can say that it's a it's very good product. And
049so I was very excited when we were able to communicate with the RSOC about this offer and that this was the tool that that that they had already partnered with to use. So this is this has been very exciting that we can now provide this to all of our schools. I I guarantee you team that for all the schools that take advantage of this your threats through email will be heavily reduced never to zero but definitely make an impact especially if you're using just the default tools available through Microsoft or Google. This is miles above that. And of course it is AI driven the many threats that we get that are AI, we have at least one AI component that's helping us and not hurting us. It integrates directly with Microsoft 365 or Google Workspace
050via API so it does not require you to change email exchange records, modify DNS or anything like that. There's just some configuration that the RSOC will guide you through on making it enabled at the beginning. They'll start you off with sort of a view only mode so you can see what what it's capturing. Once the team is ready, they'll put you in in the actual protection mode and it'll actually stop any of the threats going into your inbox. And the RSOC will provide details into that. It is easy implementation, minimal work effort for the schools. How to get it first again is complete the survey. Once the survey is completed, you will need to sign an interlocal contract with UTRSOC. Even if you have one already with MSS or with any of the other RSOCs,
051you need to have one because each each service is different with the UTRSOC. If you already have one for a different service with the UTRSOC, you do not need a new one. It'll be the same one but just be aware that often times the IOC requires approvals and signatures from the board. So if this is going to be sort of the hurdle at the beginning for for the school systems and I recommend that you reach out to the RSOC and and get that process started. At the same time, complete the survey so that we can queue you up. Pre-registration is required like I mentioned so that survey is important because this is how we're going to at least at the beginning make the tool available to different schools. And remember as always, all these services
052are first come first serve and so we were going to dish them out as quickly as the RSOC can onboard folks until we are out of licenses. I think I may have already said this but if you're already receiving RSOC services from the UTRGV or San Angelo State, please let the UTRSOC know. Oh and then and they will coordinate this service with your existing RSOC. So that is a note to say that if you are currently a UTRGV or ASU RSOC customer you will be getting the service from the UTRSOC in Austin. However, if you let them know that you are current customer of either the ASU or UTRGV they will make the console available to those RSOCs so that you're still dealing with the one RSOC. We did not want to complicate things and
053have you communicating for different things with different RSOCs. If you're already a customer of one, you still can get the service and continue to be a customer with that RSOC without complicating things on your end. We tried everything to make sure that everything was easy for for the school systems to take advantage of without complicating anything. Now there's bound to be some hiccups I'm sure and we'll deal with those as they come up. So if there is something that comes up, please always communicate with the team and we will get to it and and you know knock heads until we figure out how to get past it but nothing is undoable if you communicate with us. Email security service and implementation timeline. So a lot of the schools asked what does this look like from
054a you know how much time is it going to take for us to implement this? So we asked the UTRSOC for us just a super high level of what this may look like and and this is what they shared. So phase one, administrative setup and intake typically takes about 5 minutes. I'm sorry five five business days but it's about a 10-minute effort. So the IOC will be reviewed, signed and returned to UT. Onboarding form is completed and captures user account, email platform and key details. This is the beginning information that the RSOC needs to know what work is going to be needed. Phase two is the actual integration initial data ingestion. So the integration link is sent to the designated point of contact and completed. Separate links are required for Office 365 and Google if
055both are used but they will send one depending on what platform you're using. Initial data ingestion dashboard availability, they'll let that cook for about two to 24 hours and then user account creation and welcome communication will be done. So anybody who is going to need access to view the console and stuff you'll be given access to that typically your your IT coordinator and your cyber security coordinators so they have access to see what's in there. The again the tool will be placed in passive alert only mode for about 10 days. This allows the tool to learn the environment, kind of learn what is standard and what is not and then of course the AI will be busy because each AI instance is specific to the implementation right? So Abnormal builds behavior understanding of users and
056email patterns for the given school system. So this is where the tool is learning AI is learning on everything that's going on with about 10 days. After that, they will transition to active protection which again is just really short. Activation link is deployed to enable full protection, full enforcement and protection is enabled within 24 hours after activation. So after phase four, you are fully protected by the service and good to go. Ongoing monitoring and tuning within the first few days so continuous monitoring tuning optimization based on findings and user needs. All of that team is handled by the RSOC. So this product this this initiative was like many of our other ones meant to be as hands-off as possible. So the RSOC will be monitoring and tuning. If you've got any questions or you need
057any assistance with the stuff, you don't have to go and learn a new tool. Just communicate with the RSOC team. I'm sure they'll give you the contact information and they will tweak the knobs needed for you based on your current need and and ensure that the is not blocking anything they shouldn't be blocked but blocking things that it should be blocking and maybe it's missing. At the beginning, it's going to have to learn. It's going to maybe miss some things or be too restrictive but the RSOC will be monitoring all that along with you and just communicate with them and and they'll make those adjustments until the tool is just doing its thing. After a while, for the most part it is a set it and forget it especially since the RSOC team will be
058monitoring this for you So again, it's it's a great service. I'm glad we were finally able to finish the documentations that allow us to be able to provide this to our schools. I'm very excited for all the schools to get this email security service. Sort of an update on the EDR realignment. So the target date is still May 1st, 2026 where we will be adjusting the approved count. You should have received an email from do not [email protected] with your report of your current status. Excuse me. The emails were sent to the superintendent and technology coordinator of all of the school systems based on the information that we got from AS TED. This is why I've communicated in the past team, it is very important that you keep those contacts updated so that when we communicate
059these important things that they go to the proper place. We do get bounce backs. We we had did have to kind of you know work around that. We're getting better at the collection of of contacts but it's very helpful if you guys keep the AS TED information up to date because before we send out any type of mass communication like this, we always get a sync from AS TED to make sure that we're communicating with with current folks. This time around, we also left a couple of old folks just to make sure that we didn't miss anybody. So if we send some to IT directors and stuff that are not in your school, apologies but we really tried to make sure that all the schools were aware of the current EDR report. This is a
060sample of what the report looks like right? So for this sample school, they were they were approved for 1,000 agents and we would have reported that they were at about 6,930 deployed which was about 69% which means they are below the 90% so they would have received this report. The report also included the average active EDR agents by month. So the report that the graph there at the bottom is not the deployment for any given day. It's the average. We collect we we I'm sorry. We collect a weekly sync of all of the agents that are deployed to a school and then that report sort of aggregates the the average for the month. April had a dip only because we're still in April, right? So a lot of school like, "Wow, I don't know why
061why why is my my count down?" And it's it's it's because we're not completed in April, right? So so far the information that we've collected for your average which typically does we understand tick up and down, right? As some computers are are left off for for maybe 30 days or come back online, we do know that that that average number typically changes. So always pay attention to the month prior. And the month prior to say that sort of steady line is is your deployment. So when we see this, we can see that a school for the most part has averaged only about 7,600 agents. So it would tell us that they probably don't need about, you know, 2,000 of those. And this is what we're adjusting to. So the realignment goals just as a reminder,
062we want to encourage schools to fully deploy the EDR agents that you need. Approved count will be adjusted down to your deployment level. This should allow TEA to fully utilize its available agents. Only schools deployed at less than 80% should have received the report. After realignment, we don't want to scare schools away. If you after realignment, if you're deploying more and you determine, "Hey, I still need more." You can always submit an add-on request through our add-on process. And we will approve them as we have licenses available. If we don't have licenses available when you request to add-on, we will place you in a queue and get to you as quickly as we can. If you have extenuating circumstances and cannot fully deploy by May 1st, just let us know. A lot of the schools
063that received the report have let us know, "Hey, we we're not able to complete that. We're working on different things." Some of them had hardware refreshes. Some of them were delayed because of STAR testing and things like that. Just let us know that you need some time and we will, you know, make note of that and and be be careful of of of the adjustments. We we The adjustment really team is is not meant to say that you are now limited to only those. What we're trying to do is to make sure that we understand actual need for all of the schools across Texas and that we can report that need based on actual deployment numbers. We we're shifting from where we just kind of gave everybody 30% and just kind of let everybody live
064that way to more we only give the schools what they need. And if they need more, they can communicate with us, go through an add-on process, and we'll happily give more as long as agents are available to make sure that the schools are 100% covered for all in-scope systems and are fully protected. Don't be like a few unfortunate schools that have unfortunately communicated to us that they were victims of a ransomware attack that were in the program but unfortunately had not fully deployed to all their endpoints. And so the ransomware found the weaker endpoints and that's how the school winded up in some issues. We are really trying to make sure the schools avoid that. And the only way to do that is to make sure that your school system is 100% covered on all
065in-scope systems. EDR is first come in first served and we've been sort of communicating this sort of image to show where we're at. So for the current biennium, 35 million was allocated for EDR. So doing rough napkin math, that came out to about 326,000 EDR agents that we could deploy. So that is our max cap. So the trend as we reported through different of these CCFs, January we reported 256,000 agents deployed at 79%. February we reported 273,000 agents so 84% and for April we are now at 313,567 agents deployed. So a 96% of that number. If we went solely by what has actually been approved for all the schools, we would be at 433,000 agents which as you can see we're over subscribed, but the schools are not using those agents. So this is why
066it is important for us to be able to show that we are using up all of the agents that we have said that we would use. And if we run out of funds, then we can and the legislature is about to open up request additional funding. It's hard for us to request additional funding if we still show that we have a lot of agents that are not being used. I prefer to go with the story of, "Hey, this is the queue of schools. We're at maximum allocation and these schools still need so we need another, you know, 100,000 agents and then we get funds for those so that we can continue the the the goal of that." So just because we run out of licenses and you're placed in the queue does not mean that
067we won't be able to support you. All of the schools that are already in the program, we will always continue to support. But if we need additional licenses, we need to know what that number is so that we can request those additional funds. We are very close to our max team. So great job everybody out there. A couple of upcoming events. So the um managed security services K-12 EDR webinar that is being hosted by both TEA and SAIC will be on May 5th from 2:30 to 3:30. The link to join is there. We will make the slides available to our typical website. So afterwards, you know, you can find this and the recording on the website. So I know that it's kind of hard to grab the link from the screen, but once we share
068the slides, you can just click on the link and go there to sign up for for the for the webinar. The webinar is to allow existing MSS customers to sort of get to know SAIC and what the services that they provide and and and and how they can be reached during you you need additional assistance or things like that. And also for any schools that are currently not in the EDR that just have questions about what it all means and things like that. It's not too late to get more information. So this this webinar is being um for the most part done by SAIC to be able to answer any questions to current and any future customers to to the program. The 27th annual ISF in Austin will be taking place on May 20th and
06921st on the Palmer Events Center. I have been told that it is at max cap. And so if you were able to grab a ticket while they were still available, congratulations. If you are planning not to go to the ISF this year, please let the team know so that they can release your ticket and give it to somebody else. They do have already a waiting list of of folks that are wanting to get in, but they're currently at max cap. I'm told through through little spies I have here and there that they are thinking of moving the ISF to a bigger venue to sort of build capacity and and and be able to allow more people. Where that might be, they haven't really said. So just note that it may move from Austin at least
070in in for the interim as they get a bigger place. That's through the grapevine, not official. But so I never told you this. And then Region 1 the technology conference is going to have their annual technology conference at the South Padre Island Convention Center in May. I will be attending and having a session there if for those folks that are from the Region 1 area and have questions specifically on this. If any of the other ESCs in the audience have anything um events coming up you want us to communicate this, we can communicate them this in the upcoming events and and and make them available so that the folks at the CCF are aware. But these are some of the upcoming events that we are excited about all of them that we'll be presenting in.
071So just as a wrap-up cuz we're out of time team. Thank you for sticking with us. The K-12 initiative website it's if you do a quick search and do TEA and cybersecurity, that's the first thing usually that pops up. But there's a link on there where include steps for onboarding school systems to the MSS program, updates about the program, frequently asked questions, a handy link to sign up for the cybersecurity career forum which is what you're in currently. And of course we post the recordings and and questions and things like that in the frequently asked area. All nice and handy in in in in the website. If you have any questions on the K-12 cybersecurity program, there is the email to send and the team will respond. The the email does not go to one
072team member, it goes to our group. And so that's the best way to to to get a hold of us because in case one of us is busy or not available, that is the email that somebody will will will get back to you as soon as feasible. So please use that. The cybersecurity team does host this meeting like I I mentioned before. Our next CCF will be May 27th at 11:00 a.m. There's a handy link for you to sign up for the next one. If you're signed up for one already, you automatically sign in for the rest. But if you need to share with any of your your compadres in other school systems that maybe are not already signed up, please share the link with them. We would like to see an increase in in
073attendance to to these meetings. There's a lot of information that we share not only on the K-12 initiative but on on different things that are impacting our schools. And it's a great place to ask questions and we'll get back to you as soon as we can to make sure that you're informed. That's it for our session. Stay safe and secure out there. Thank you for all the work you do in securing our schools. And again, if you have any questions, please email the team. Thank you very much.