Client Project: Penetration Testing to comply with the Safer Technologies 4 Schools Framework

Educational institutions and the technology providers that support them are under increasing pressure to demonstrate strong, transparent cybersecurity practices. Schools are responsible for safeguarding highly sensitive data — including student information — and are now expected to assess and manage cyber risk in line with the Safer Technologies 4 Schools (ST4S) Framework.

One of the most effective ways to support ST4S requirements — and to reduce the risk of costly cyber incidents — is through regular penetration testing and vulnerability assessments.

Recently, the team at FortiTech was engaged to undertake penetration testing for a client as part of their efforts to align with the Safer Technologies 4 Schools Framework. This engagement demonstrates how independent security testing plays a critical role in helping organisations provide assurance to schools, manage risk responsibly, and build trust in educational technology.

What Is the Safer Technologies 4 Schools Framework?


The Safer Technologies 4 Schools (ST4S) Framework, developed by Australian education authorities, provides a consistent, risk‑based approach for assessing the privacy and security of digital products and services used by schools.
The framework focuses on:

  • Protecting student and staff personal information
  • Identifying and managing cyber and privacy risks
  • Promoting transparency and due diligence from education technology providers
  • Helping schools make informed decisions about the technologies they use
For vendors and service providers, demonstrating alignment with ST4S is becoming increasingly important. It shows a commitment to safer digital environments and provides schools with confidence that cyber risks are being taken seriously.

Why Penetration Testing Matters Under ST4S

Penetration testing — often referred to as “pen testing” — is a simulated cyberattack designed to identify vulnerabilities before malicious actors can exploit them. Within the context of ST4S, penetration testing supports several key principles of the framework by:
  • Identifying technical risks that could affect data confidentiality, integrity, and availability
  • Validating the effectiveness of existing security controls
  • Providing documented evidence to support risk assessments and assurance processes
  • Demonstrating proactive risk management rather than reactive incident response
Rather than being a box‑ticking exercise, penetration testing helps organisations genuinely reduce exposure to cyber threats — supporting both ST4S expectations and real‑world security outcomes.

Our Approach: Practical, Real‑World Security Testing

For this engagement, FortiTech followed a rigorous penetration testing methodology aligned with recognised industry standards, including OWASP, NIST 800‑115, and best‑practice vulnerability management guidelines. Using globally recognised frameworks ensures our testing is thorough, repeatable, and relevant to the threats facing education environments today.

Our assessment combined leading security tools — including Nmap, Nikto, SSLyze, OpenVAS, and targeted manual testing — to simulate the techniques used by real‑world attackers. The testing was conducted using a black‑box approach, meaning we operated with no prior internal knowledge of the client’s systems.

This method closely mirrors how an external threat actor would attempt to compromise systems and provides schools and vendors with an honest view of their security posture.

Scope of the Engagement
The penetration test included:
  • The primary business domain and associated public IP addresses
  • All public‑facing web applications
  • Web server security configurations (HTTPS, HTTP headers, SSL/TLS settings)
  • Vulnerability scanning against the latest known CVEs
This scope ensured coverage of the most common attack surfaces relevant to ST4S risk assessments.

Why Choose FortiTech for ST4S‑Aligned Penetration Testing?
At FortiTech, we don’t rely solely on automated scanning tools. We combine advanced technologies with experienced manual analysis to uncover issues that automated testing alone can miss.
Our reports are:
  • Clear and actionable
  • Aligned to real‑world risk, not just technical severity
  • Suitable for sharing with schools, governance teams, and assessors
As part of our commitment to delivering meaningful outcomes, we also include one complimentary retest within 14 days of the initial engagement. This allows your team to remediate identified issues and have fixes independently verified at no additional cost.

How We Can Help
We work with schools, education providers, and technology vendors to deliver penetration testing aligned to the Safer Technologies 4 Schools Framework. Our services help you identify cyber risks early, support ST4S risk assessments, and demonstrate your commitment to safer digital learning environments.
If your organisation supports schools or is preparing for ST4S assessment, FortiTech can help you strengthen your security posture with confidence.