Could your school be impersonated?

“Around 96% of schools' emails can be forged - very, very easily,” is the blunt warning from cybersecurity expert Adam Burns.

According to Burns, founder of Blackveil Security, it's not just schools: much of our critical online infrastructure has massive blind spots in basic internet security. He describes it as a “house of cards” at risk of being blown over by a new wave of AI-powered attacks.

The warning comes at a time when large-scale attacks are rocking nations worldwide.

A rogue AI system recently hacked Australia’s Medicare, on Tuesday, French supermarkets lost refrigeration following an attack, and our own cyber-security agency reported the same number of critical threats in the past year than in the whole past decade.

But for a parent, the threat could look much more innocuous. Imagine getting an email from your child’s school chasing up a late payment for a trip. You do your due diligence: you check that the email address is familiar, all the details are correct, and the link take you to a legitimate-seeming website. You make the payment and the next day, your accounts are locked and your savings gone. That’s the very real risk facing many Kiwis, according to Burns.

So, where are the blind spots making that risk so stark and more importantly, what can we do about them?

The House of Cards

The issue identified by Burns isn’t with a complex piece of malicious code buried deep in a server, it’s the digital equivalent of an unlocked front door: email. A lot of technical architecture is required to keep email secure.

It relies on three core mechanisms, called SPF (which lists approved sending servers), DKIM (which attaches a cryptographic signature to outgoing messages), and DMARC (which tells recipient servers what to do if an incoming message fails authentication).

DMARC has three policy enforcement levels: monitor mode, which logs fake emails but delivers them anyway; quarantine, which routes them to spam; and full rejection, which blocks forged messages completely.

In almost all cases, people should set their level to full rejection.

But, says Burns, only four per cent of schools in New Zealand have their DMARC settings configured that way. That’s compounded by the fact that only 34% of schools have properly configured SPF to prevent their addresses from being used in fraudulent emails.

Burns’ research is based on publicly-available DNS records, which is the internet's directory of domain settings.

Don’t worry too much about the jargon: the essential takeaway is that if these settings aren’t enabled, an organisation is vulnerable, both to receiving fraudulent emails and having its exact domain name spoofed by scammers.

It’s the digital equivalent of posting a security guard at your front door, but telling him to wave everyone through no matter how suspicious—while hundreds of perfect fake employee badges also circulate freely outside.

When people think of "hacking," they often picture someone in a dark room wearing a hoodie, typing feverishly into a terminal before declaring, "We're in!" In reality, the vast majority of breaches are variations of a phishing attack—where an attacker impersonates a trusted individual or organisation via email and essentially walks right through the front door. AI now allows people to make thousands of these attacks a day with an unprecedented level of authenticity.

“I've been saying the same thing over and over again for two years. I saw it for almost two decades working in tech. Every single hack that I was involved in was the same thing: a phishing email,” says Burns.

This strategy is effective because email acts as the master key to digital identity.

Most online services offer one-click sign-in via email. It is also the destination for password reset links, multi-factor authentication codes, and identity verification notices. If an attacker compromises an email account, they gain administrative control over the rest of the target's digital footprint.

Today, generative AI tools allow bad actors to automatically draft emails using exact domain names, matching brand assets, and authentic tone of voice.

Schools are far from the only vulnerable sector. Burns’s audit shows severe gaps across healthcare, with public health domains passing at just 24 percent and private health at 17 percent—meaning a family doctor’s email could be forged with relative ease.

The Government Response

The Government is aware of the threat and is working to shore up cyber defences, though critical gaps remain. Secure Government Email (SGE) is a set of email-protection mandates issued by government authorities for core public sector domains. One of the primary technical requirements is configuring DMARC to its strictest setting: ‘Reject’.

A spokesperson said implementation across core government agencies is nearing completion, with roughly 79% of participating domains currently set to ‘Reject’ and full rollout expected across core agencies in the coming weeks. While progress on securing official government domains ending in.govt.nz is a clear positive step, Burns stresses that vulnerabilities remain widespread among small businesses and broader public institutions.

Crucially, standard government frameworks like SGE often cover only specific core agencies—leaving out regional hospitals, local councils, and schools.

The Ministry of Education said schools should consult their agency Network for Learning, which has funding to operate the email protection service used by many schools.

“Schools are encouraged to regularly review their cyber security settings.. keeping school communities safe online is a shared responsibility, and everyone has a role to play in spotting and reporting suspicious emails.”

While turning on the right security settings sounds like a quick toggle, Burns says clearing technical debt across broader public infrastructure could take "hundreds of thousands of man-hours" to resolve.

“If they could identify them, go, 'that should not send mail, that should, this is what it does,' then easy. But the chances are they will have no idea because they haven't had eyes on it for decades. So each domain—think about it as a one-month project potentially,” Burns explains.

“I've been shouting into an echo chamber for two years. People don't do anything about this stuff until they get hacked because it's easier to approve a line item for an emergency issue.”

The time to act is now

Experts like Burns, our own cyber-security agencies and the world’s biggest tech companies have spent the past few years raising increasingly loud alarm bells.

Microsoft cyber-security lead Mark Anderson told Stuff the time of ‘wake up calls’ is passing, because AI is already supercharging the ability to conduct cyber attacks at an unprecedented scale.

“For many years we keep having wake-up calls, it feels like it's the ‘no, no, we are now shaking you violently to wake up and get out of bed and go, you've really got to start’,” he says. “We can't just keep talking about fixing the foundations and the fundamentals; we have to get on with it now.”

Fortunately, while the technology used by attackers is becoming more advanced, the best defences remain basic. Business owners should audit their domain records to confirm SPF and DMARC settings are active and monitored.

For everyday Kiwis it means keeping device software updated, ensuring multi-factor authentication is enabled across all accounts, and always verifying unexpected emails requesting money or sensitive information with a phone call before clicking any links.

Basic digital hygiene should keep you you safe 99 times out of 100: unfortunately, the bad guys only need to get lucky once, and new technology is giving them a lot more opportunity to roll the digital dice.