School districts are attractive targets for email attacks due to large staff directories, high message volume, and lean IT security teams. Standard spam filters often miss compromised internal accounts because individual messages appear ordinary.

Two districts experienced this vulnerability firsthand through a weekend email blast, a multi-district phishing campaign, and fake document-sharing links, none of which triggered traditional filters.

Both districts started with Wizer Email Security (WES) in pilot mode: a watch-only deployment that scores every message exactly as it would in production, logs what it would have done, and takes no action and shows the customer nothing. It's built to let a new customer see the real value before flipping on blocking as a low-risk way to evaluate email security without any chance of a false positive disrupting mailboxes on day one.

Rather than scoring each email in isolation, WES also scores behavior across a whole set of messages at once — volume, timing, and the relationships between sender and recipients. That broader view is what surfaced every incident below.

District 1: On a Saturday night in mid-October, nobody at the primary 906-mailbox district was watching a dashboard. WES was simply logging what it would have done. By Monday, that log held three separate real attacks from the same weekend:

1. A compromised staff account, caught mid-blast. At 12:46 a.m., one already-compromised staff mailbox sent 962 emails to 621 of the district's 906 mailboxes all under 13 minutes.
2. A coordinated, multi-district campaign. Two other school districts, in different states, were separately compromised and used to send the same phishing lure 15 minutes apart. The version aimed at this district carried a fake internal email thread impersonating the district's own superintendent.
3. A phishing link disguised as a shared document. A compromised account "shared" what looked like a Google Drive file; 125 messages reached 65 mailboxes with the phishing link hidden inside the shared document rather than the email itself.

None of these looked unusual email by email. What made them visible was the pattern across many messages at once.

District 2:Onboarded that same month, it took just 65 minutes after initial rollout on a Friday-morning for two compromised staff accounts to send 22 copies of the same phishing email to 10 colleagues, within about three seconds.

WES flagged all 22 lures with zero misses. The district's own staff caught the attack independently about 8 minutes later.

Had active protection already been turned on, every one of those 22 messages would have carried a warning banner before anyone had the chance to open it.

For a district weighing email security but wary of disruption, pilot mode removes most of the risk: nothing is blocked and no one sees a false positive while the system proves itself on live mail. Both districts above saw real attacks surface and get caught within days of onboarding before either had turned on a single blocking feature. Districts with lean IT teams and no appetite for a long evaluation period may be especially well served by starting here rather than waiting.