Security preparedness is important for everyone working in a K–12 environment, especially for those in school leadership. Cybersecurity and physical security incidents alike require a rapid response to mitigate damage.
Nearly 80% of IT professionals agreed that incident response was helpful to their organization, according to research from CDW. Despite the benefits, security training may not be at the top of every K–12 leader’s to-do list. This is particularly true for in-person training, such as tabletop exercises, which require coordinating meeting times across numerous busy schedules.
However, tabletop exercises build fluency and “are invaluable for rehearsing and refining responses to various scenarios,” an article in Forbes points out. “These exercises offer a safe environment for all participants, including executives, to practice decision making under pressure and become familiar with technical procedures.”
Click the banner below to explore other aspects of a strong cyber resilience strategy.
Our team at Fayette County Public Schools devised a solution. We’ve been working on a gamified incident response tool that trains K–12 leadership on the best course of action while testing their security preparedness skills, and we built it with artificial intelligence.
Training AI to Run Specific Incident Response Scenarios
Working with generative AI, we built GPTs, or generative pretrained transformers. A GPT is a type of artificial intelligence model that uses the transformer architecture to process and generate humanlike language. There are currently four scenarios that cover cybersecurity and physical security incidents, but there are many possible scenarios that could work as part of this model and could come sometime in the future.
Once the GPT is trained, other users just need a link to interact with it to play out a virtual tabletop exercise. The GPT goes through the scenario, giving information about the event and posing questions for the user to answer.
FIND OUT: What is the Incident Command System, and how does tech support it?
For example, what if the fire alarm goes off while the students are gathered at an assembly? The trainee then has to choose from the multiple-choice answers the AI model gives. If they get it wrong, the GPT is trained to share feedback on why it’s wrong and what they should have done. If they get it right, the scenario progresses.
Letting AI Do the Heavy Lifting in a Human-Led Process
The scenarios and accompanying feedback are detailed and robust, and they were built by a team of three individuals. I start planning the scenario from a high level, thinking through the “if this, then that” aspects, but AI helps us put it together, saving time and effort on the tedious task of aggregating all the data.
Once the GPT scenarios are developed and added to the AI model, it’s important to maintain the training. As time goes on, buildings, technologies and best practices will change, which will require updates to the scenarios and to the data the AI model is trained on. Internally, we plan to readdress the data regularly, but beyond that, we hope to share these with other K–12 schools, who will need to do the same.
Creating and Sharing the Virtual IR Exercises Responsibly
These training modules are built through ChatGPT, so we need licenses to create them and to train the AI, though it’s free for users to engage with the GPT once they have the link.
We recently had our security team play through a school safety scenario in a meeting, and they thought it was powerful. We’re making sure all the leaders who should be involved in building the training are working on creating and updating the GPTs.
79%
The percentage of respondents who agreed incident response is somewhat or very helpful to their organization
Source: CDW, 2024 CDW Cybersecurity Research Report, June 2024
As we prepare to share this virtual incident response tool with other schools and their administrators, data security is top of mind. We were very conscious of protecting our staff and students, physically and online. The training is built with general information or numeral ranges. There’s no specific data in these scenarios (such as where our security cameras have blind spots or how to bypass our cybersecurity protections), and there was explicitly no personally identifiable information fed to the AI model.
DIVE DEEPER: Data governance is key for safe AI implementations.
As another layer of protection, all of the answers are multiple choice. There are no prompts for staff to enter any of their own or student’s data into the model. We built in parameters to keep users on track and data protected — an essential aspect of any AI project.
As users train on these GPT scenarios, they’re met with humanlike language and feedback. Working through the scenarios may feel a bit fun, like playing a game or reading a choose-your-own-adventure story. But at the end of the day, school leaders are developing and practicing skills that they will need in an emergency. Changing those skills into muscle memory will make it that much easier to flex them.
