One partner, full coverage for cybersecurity in the education sector, from a compromised login to a national exam going down. Since 2002, eBuilder Security has delivered cybersecurity for schools and other education providers, so no institution has to build its own 24/7 team.
Download the Education Sector NIS2 Readiness ChecklistTrusted by 100+ Swedish Kommuner, Regions and
EU-Regulated Organisations Since 2002
“Swedish education providers” covers far more than schools and universities. Skolverket’s remit spans preschool, compulsory school, upper secondary, komvux and higher education, and our services fit each differently.
Förskola and school-age childcare rely on careful handling of guardian and safeguarding data.
Grundskola runs on student records, grades and special education plans every day.
Gymnasieskola carries real risk through digital exams and shared student devices.
Komvux data often shares municipal systems with school-age records.
Universities manage research data, identity federation and large student portals.
Municipal departments oversee every school a skolhuvudman is responsible for.
Friskolor often run smaller IT teams with heavier vendor reliance.
Regional authorities oversee several municipalities and education types at once.
Student records, grades and staff data, held by schools with thin IT teams and dozens of vendor logins nobody reviewed. Attackers do not pick targets at random, which is exactly why ransomware protection for schools cannot wait until after an incident.
Sensitive citizen and staff data was exposed after a ransomware supply-chain attack compromised a single shared HR platform used across the country, including by universities that rely on it. Source: Miljödata incident, Sweden 2025.
A ransomware group targeted Tietoevry, a major Nordic IT supplier used by Swedish schools and government agencies, disrupting services that relied on its infrastructure. Source: Tietoevry incident, Nordic region, 2025.
Ransomware attacks on the education sector worldwide breached 3.96 million records in 2025, up 27% from 3.11 million in 2024. Source: Comparitech, 2025.
Stolen credentials to a customer support portal exposed student and staff records across school districts using this vendor’s student information system. Source: PowerSchool incident, 2024–2025.
On 15 January 2026, Sweden’s Cybersäkerhetslagen (2025:1506) brought the EU NIS2 directive into national law. Education providers, including schools, universities, municipal education departments and independent operators known as friskolor, should assess their position carefully.
Most education providers already run a version of this discipline. Staff need MFA to reach Skolverket services through Skolfederation. NIS2 asks schools to extend that same discipline, secure access, vendor oversight, documented incident response, across every system, not only the exam platform.
Use MFA for staff, admin and vendor accounts across Skolfederation, Microsoft 365, Google Workspace and learning platforms.
Prepare clear steps for serious cyber incidents, including when reporting to the MCF (formerly MSB) may be required.
Check learning platforms, classroom apps and support tools connected to student or staff data.
Help rektorer, huvudmän and school boards understand what they must approve, monitor and document.
Our services directly address all Article 21 technical controls and support Article 20 management accountability. The Education Sector NIS2 Readiness Checklist maps your current state against Articles 20 and 21, written for Swedish education providers.
Plain language, built for Swedish education providers, takes around 20 minutes to complete.
Board-ready output reflecting current MCF guidance for Swedish education providers. Delivered to your inbox instantly.
No spam. EU data residency. Unsubscribe any time.
Whatever your school runs into, one partner covers it, identity, cloud accounts, vendors, exams, all of it.
Catch AI-Assisted Phishing Early
As education providers adopt AI tools for teaching and administration, new risks emerge around student data and AI-assisted phishing. AIDR monitors AI usage, model interactions and data flows in real time.
Protect Identities and Learning Platforms
Most education providers cannot staff a 24/7 security team internally. Our Sweden-based SOC watches endpoints, identities and cloud environments around the clock, including Google Workspace and Microsoft 365. A named analyst responds in minutes.
Find the Gap Before an Attacker Does
Expert-led testing across web applications, cloud environments, APIs, network infrastructure and Active Directory environments common in Swedish education sector IT. Clear prioritised findings, not a report that sits unread.
Protect Staff from Phishing
Short, role-based training lessons and realistic phishing simulations designed for teaching staff, administrators and IT teams. Builds genuine awareness rather than checkbox compliance, with measurable results from week one.
Protect Leadership from Blind Spots
Most education providers do not have a dedicated CISO. We provide senior security leadership for NIS2 governance, incident reporting, ed-tech vendor risk management and school board accountability without the cost of a full-time hire.
FREE 30-MIN SECURITY REVIEW
Book a 30-minute review. We’ll review your current posture and tell you exactly what matters most.
Talk to a Security AnalystWe are a Swedish security partner focused on transparency, consistency and long-term trust for Swedish education providers. One of our longest active MDR engagements has run for over 4 years with zero breaches recorded.
See How We Map to Article 21The industry talks in hours. We measure in minutes.
Human analysts watching every signal. Logs stay within Sweden-based infrastructure.
MDR can be live within 72 hours once access and approvals are in place.
Cybersecurity practice within eBuilder, a Swedish technology company operating since 2002.
Independently audited and certified to the ISO 27001 standard for our SOC.
All services mapped to NIS2 Article 21 risk-management measures and aligned with MCF guidance for Swedish education providers.
Human-led monitoring and infrastructure aligned with GDPR and Schrems II requirements.
Services support ICT risk management, incident reporting and third-party oversight under DORA.
We build the rollout around your school calendar. Most education providers are live within 72 hours, timed to avoid exams and enrolment.
Sensors install through your existing device management. Nothing changes for teachers or students.
Our systems spend a couple of days learning what normal traffic looks like, so real alerts stand out.
Your school is active inside our 24/7 SOC, with a named analyst and runbooks built for how you operate.
Monthly summaries and quarterly check-ins keep your board briefed and NIS2 records current.
The product increases knowledge and security awareness. I am particularly pleased that it is an end-to-end solution where eBuilder Security takes care of the entire process from kick-off to reporting, while allowing for customization to suit the conditions unique to our business.
Per Eriksson
Information Security Strategist, Varbergs Kommun, Sweden
Through their range of security services and our decision to choose their MDR solution, eBuilder Security has significantly elevated our security posture. During the implementation phase, they were quick to assist and propose solutions to any challenges we encountered. The transition from project to production has been smooth.
Gerth Ericsson
IT Manager, Vandewiele, Sweden
eBuilder Security helps us meet our IT and information security needs. We are very satisfied by their deep knowledge, comprehensive services, and dedication to strengthening our cybersecurity posture. eBuilder Security has been a reliable partner in safeguarding our organization.
Christian Sørensen
Internal Operations Director, Médecins Sans Frontières, Norway
Browse by topic to find the answer you need.
Cybersäkerhetslagen (SFS 2025:1506) entered into force on 15 January 2026 and applies broadly across Swedish public administration. Schools, universities, municipal school boards, friskolor and regional education authorities should each assess their own position, since exact scope depends on size and role rather than being automatic for every organisation. The MCF (formerly MSB) is the supervisory authority for most education providers.
Essential entities face penalties of up to 10 million euros or 2 percent of annual turnover, and important entities face up to 7 million euros. Beyond fines, supervisory authorities can prohibit a senior manager from exercising management functions. This makes cybersecurity a board-level issue for school leadership, not just an IT responsibility.
In March 2025, Skolverket shut down its national digital exam platform after student data became visible to teachers at other schools, an access control failure rather than an attack. Skolverket confirmed in November 2025 that exams stay on paper for years while it is rebuilt. Identity and access control failures stop real operations, not just IT tickets.
Teachers connect new classroom apps all year without IT ever reviewing them. We identify who has access to student data, which vendors connect directly to school systems, whether those accounts carry MFA, and whether anyone would notice unusual vendor activity, then document findings against Article 21 supply chain requirements on an ongoing basis.
MDR is a 24/7 service where dedicated analysts monitor your environment, investigate alerts and contain threats in real time. IT support keeps systems running. MDR keeps attackers out. Most schools do not have a security operations centre watching for threats at 2am on a Saturday, and that is what MDR provides.
No. MDR works alongside your internal IT team and does not replace them. Your IT team manages infrastructure, devices and user support. Our SOC focuses on threat detection, investigation and containment. We define clear escalation paths at the start of every engagement so everyone knows their role when something is detected.
Once onboarding access and approvals are in place, most education providers are live in our 24/7 SOC within 72 hours. Sensors deploy silently through your existing MDM on day zero with no disruption to lessons. By hour 72, a named analyst is assigned and escalation runbooks are written for your school.
No. Onboarding is completely silent. Sensors deploy through your MDM with no notifications, no system restarts and no changes to learning platforms or student-facing systems. Teachers and students will not notice anything has changed. This matters most during exam periods and enrolment windows when disruption has real consequences.
Skolfederation itself is operated by Skolverket, not eBuilder Security. What we do is extend the same MFA and identity discipline your school already uses for national exam access across your other systems, and our SOC pays close attention during exam weeks and other high-stakes periods when disruption matters most.
Three categories matter most: children’s personal data such as records, contact details and guardian information; staff and administrative data including payroll and leadership communications; and learning or exam data such as grades and assessment files. IMY, Sweden’s data protection authority, treats children’s data as carrying extra weight under GDPR.
Security logs and telemetry are processed in Sweden-based infrastructure, aligned with GDPR and Schrems II requirements. This is a contractual commitment in the service agreement, not a marketing claim. eBuilder Security does not route student or staff data through US-based infrastructure. Full data flow documentation is available for your DPO.
Yes. Parent and guardian accounts often reach grades, attendance and contact details, which makes them a route into student data that gets less attention than staff accounts. Treating parent portal access as part of your identity and access review, not an afterthought, closes a gap that ed-tech vendor risk reviews commonly miss.
Yes. Students and teachers regularly log into school systems from personal laptops and phones that IT never fully controls, and that gap in visibility is a real target for attackers. We cannot manage the device itself, but our identity and cloud monitoring can flag suspicious sign-ins and account activity regardless of what device they come from.
Pricing for education providers is based on endpoint count, with one predictable monthly fee covering MDR. That fee already includes incident response, analyst escalation and alert handling, none of it comes as a surprise extra. Penetration testing, CISO as a Service and security awareness training sit outside MDR and are scoped separately based on what you need.
Larger platforms are built for enterprise corporations, not Swedish education providers. eBuilder Security is Sweden-based, Swedish-speaking and has served Swedish public sector organisations since 2002. Your student data stays in Sweden, your analyst knows your environment by name, and our service is sized for teams that cannot build a 24/7 security operation internally.
Talk to a Sweden-based analyst for 30 minutes, no cost, no obligation. We’ll walk through your current setup, flag what actually needs attention first, and show you the SOC in action.
Get the Education Sector NIS2 Checklist