In the classroom
Four grade bands, four weeks, matched to the staff emails — so a fifth grader and her teacher are on the same topic the same morning. Everything here is free and runs in Chrome on a Chromebook. Where a login is needed, it says so.
Primary · K–2 · Mrs. Groves’s building. Smartboard only, 10–15 minutes a week, teacher driving. Don't plan on email reaching this band. Keep it projected, and send the family tip sheet home in folders.
Ask this today
One question, first two minutes of class. It ties to whatever the staff email said this morning.
Day 1. Ask: what is a password for? Take three answers, don't correct any.
Day 2. Tell them 60 million kids had their school information taken by one person. Ask how that feels.
Day 3. Show a pop-up that says YOU WON. Ask: real or pretend? How do you know?
Day 4. Ask: if a grown-up you don't know asks you to do something, what do you do first?
Day 5. Ask: who do you tell when something on a screen feels wrong? Get them to name a real person.
Day 6. Ask: could someone pretend to be your mum or dad in a message? How would you know?
Day 7. Recap week one in one sentence: some things on screens are pretend.
Day 8. Ask: is a password a secret? Who is allowed to know a secret?
Day 9. Ask: if you use the same key for your house, your bike and your locker, what happens if you lose it?
Day 10. Ask: where do grown-ups keep all their passwords? Let them guess.
Day 11. Ask: has anyone ever seen a grown-up type a password? Could you see it?
Day 12. Recap week two: longer is stronger, and a password is only yours.
Day 13. Ask: if your phone buzzed and asked “is this you?” and it wasn't, what would you do?
Day 14. Ask: what makes a lock better than no lock?
Day 15. Ask: if you left your bike somewhere and forgot, would you want someone to tell you?
Day 16. Ask: if you install a game, what is it allowed to see?
Day 17. Recap week three: if something feels funny, tell someone.
Day 18. Ask: why does a tablet sometimes need to restart?
Day 19. Ask: could a computer copy your teacher's voice? Let them react.
Day 20. Ask: should you type a friend's name into a computer game? Why not?
Day 21. Ask: if you tell one person a secret, how many people know it now?
Day 22. Celebrate. Ask what they remember. Anything they say is a win.
Oct 1–9Real or pretend?
Spotting fakes · 10–15, on the board · Staff are doing phishing this week.
- Project Reality River and play it as a class — you drive, the class votes on each answer out loud. Second grade can read it; K and 1 will need you reading aloud.
- Then the sorting game: you say a thing, class gives thumbs up for real or thumbs down for pretend. “A game says you won a prize.” “Your teacher asks you to line up.” “A pop-up says your computer has a virus.”
- Finish with the sentence, said out loud together: “If the screen asks me for something, I ask a grown-up first.”
Oct 12–16Strong or silly?
Passwords · 10–15, on the board · Staff are doing passwords this week.
- Project Tower of Treasure and play as a class. It is the password level and it is the right length for this band.
- Then thumbs up or down: you type a password on the board, class votes strong or silly. Try
cat, thenpurple-tiger-pancake, then123456. - The one idea to land: longer is stronger, and a password is only yours. Not even your best friend.
Oct 19–23Green, yellow, red
Who is really asking? · 10–15, on the board · Staff are doing accounts and identity this week.
- Internet traffic light. Green means fine, yellow means ask first, red means stop and tell someone. You read a scenario, class calls the colour out loud.
- Scenarios that work: “A game asks for your real name.” “A video you like is playing.” “Someone you don't know wants to chat.” “A button says click here to win.”
- Practise the actual sentence, out loud, twice: “Something on the screen made me feel funny, can you look?” The point is that they have said it before they need it.
Oct 26–30Close the loop, and send it home
Your footprint, and what AI changes · 10–15, plus folders · Staff are doing devices, AI and privacy this week.
- One last discussion: what would you do if a game asked for your real name? Hands up, no wrong answers, let them argue.
- Recap the month in three sentences they can repeat: ask a grown-up, longer passwords are stronger, if it feels funny tell someone.
- Send the family tip sheet home in folders. One page, no login, and available in nine other languages if you need them. This is the piece that actually reaches the parents.
Intermediate · 3–5 · Mrs. Benson’s building. Whole-group, with a self-paced option each week. The sweet spot for Interland and for join-by-code review games.
Ask this today
One question, first two minutes of class. It ties to whatever the staff email said this morning.
Day 1. Ask: how would you know if a website was pretending to be a different website?
Day 2. Ask: if someone got into the school's computers, what about you would they see?
Day 3. Hover a link on the board without clicking. Show them the address that appears. Most have never seen this.
Day 4. Ask: someone messages you pretending to be your teacher. How could you check for real?
Day 5. Tell them staff get points for reporting suspicious emails. Ask: who should students tell?
Day 6. Ask: why would a scammer want to change where someone's paycheck goes?
Day 7. Recap: the address is the tell. Ask if anyone hovered a link this week.
Day 8. Ask: if a company you used got robbed, is that your fault? (No. That's the point.)
Day 9. Ask: how many places do you use the same password? Don't make them say it out loud.
Day 10. Show them Chrome already has a password manager built in. Most have no idea.
Day 11. Ask: could someone in this room work out your password by watching you type?
Day 12. Recap: three random words. Ask who changed one.
Day 13. Ask: if you get a code you didn't ask for, what does that mean? (Someone has your password.)
Day 14. Ask: what's a second lock on an account, and why would you want one?
Day 15. Ask: how many devices are signed into your account right now? Nobody knows. That's the point.
Day 16. Ask: a free add-on asks to “read everything on every page”. Should you say yes?
Day 17. Recap: don't say yes to a prompt you didn't start.
Day 18. Ask: what does an update actually do? (Fixes holes someone else already found.)
Day 19. Ask: if a voice on the phone sounds exactly like your mum, is it definitely her?
Day 20. Ask: if you tell a chatbot something, where does it go?
Day 21. Ask: “anyone with the link” means who, exactly?
Day 22. Celebrate, and put the posters up. Ask what they'd tell a younger kid.
Oct 1–9Spot the fake
Spotting fakes · 20 · Staff are doing phishing this week.
- Watch the Phishing video from the CYBER.ORG series — about four minutes, no login.
- Play Reality River. Most of them will want to finish it.
- Spot the fake: project three messages, class votes on which is the scam and has to say why. The reason matters more than the vote.
- Optional: run the grades 3–5 Phishing Kahoot. They join by PIN, no accounts.
Oct 12–16Build a class passphrase
Passwords · 20 · Staff are doing passwords this week.
- Watch Making Strong Passwords from the CYBER.ORG series.
- Play Tower of Treasure.
- Build one together: three random words shouted out by the class. Write it on the board and talk about why it beats
Tr0ub4dor!— it is longer, and length is what actually matters. - Print the word search for early finishers.
Oct 19–23What counts as private
Who is really asking? · 20–30 · Staff are doing accounts and identity this week.
- Common Sense's Personally Identifiable Information lesson. Scripted, slides included, free with an account.
- Then the gaming angle, which is where this band actually meets it: watch Online Gaming Safety from the CYBER.ORG series. Free currency offers, “account recovery” messages, someone asking for a login to “help”.
- Ask the real question: has anyone ever had someone ask for your account? Hands go up. That is the lesson.
Oct 26–30Poster contest
Your footprint, and what AI changes · 30, plus hallway space · Staff are doing devices, AI and privacy this week.
- Discussion first: everything you post is a copy, not a message. You cannot take a copy back. What would you want a future teacher to find?
- Then design a cyber-safety poster. Best one per grade goes up in the hallway for November.
- This is the highest-engagement activity in the whole student track. It is also the one that makes the month visible to parents at pickup, which is worth more than it sounds.
Middle School · 6–8 · Mr. Cunningham’s building. One good whole-group session a week plus real Classroom work. This band can handle the actual mechanics of an attack, and they find it genuinely interesting.
Ask this today
One question, first two minutes of class. It ties to whatever the staff email said this morning.
Day 1. Ask: who would actually want to hack a school, and what would they be after?
Day 2. One password protected 60 million student records, with no second step. Ask why that was allowed.
Day 3. Ask: what's the single most reliable way to tell a fake email from a real one? (The domain.)
Day 4. Ask: why do scammers pretend to be someone in charge? (Because we don't question authority.)
Day 5. Ask: what happens after you report something suspicious? Does anyone actually look at it?
Day 6. Ask: what makes an email asking for money urgent-sounding, and why is urgency the tell?
Day 7. Recap: attackers copy the design perfectly. Only the domain is hard to fake.
Day 8. Explain a data breach in one line: a company got robbed and your details were in the filing cabinet.
Day 9. Ask: why does one stolen password open several accounts? (Because people reuse them.)
Day 10. Ask: is writing passwords down bad? (Not if it's in a manager. On a sticky note, yes.)
Day 11. Ask: where do you type a password where other people can see the screen?
Day 12. Recap: length beats symbols. Ask whether anyone actually changed a password.
Day 13. Ask: a login prompt appears and you weren't logging in. What does that actually tell you?
Day 14. Ask: which is stronger, a text-message code or a tap-to-approve prompt? Why?
Day 15. Ask: an old phone you don't own any more is still signed in. Who's using it?
Day 16. Ask: an extension can read your gradebook exactly as you see it. Would you know?
Day 17. Recap: an unprompted prompt means somebody already has your password.
Day 18. IT patches the school laptops. Ask who patches the phone in their pocket.
Day 19. Teach the family safe word today. Ask them to actually agree one tonight.
Day 20. Ask: what's safe to put into an AI tool about a real person? (Describe the situation, not the person.)
Day 21. Ask: you shared a doc with a link two years ago. Who can still open it?
Day 22. Ask what one thing they actually changed this month. Then ask if they told anyone at home.
Oct 1–9How an attack actually works
Spotting fakes · 45–75, can be split over two days · Staff are doing phishing this week.
- NOVA Cybersecurity Lab. Students defend a fictional startup against escalating attacks — coding puzzles, password cracking, social engineering, network defence.
- Take the guest pass at the sign-in prompt. No account needed; signing in only saves progress.
- It is HTML5 and runs fine on a Chromebook. Budget 75 minutes for the whole thing, or run the password-cracking section alone in 20.
- The educator guide has the standards alignment and a glossary if you need to justify the time.
Oct 12–16Do the maths on your own password
Passwords · 30 · Staff are doing passwords this week.
- Watch Making Strong Passwords, then run the grades 6–8 Kahoot.
- Now the part that does the teaching: have them work out how long their own password pattern would survive a guessing machine. Not the password itself — the pattern. Eight letters and a number. The numbers argue better than you can.
- Land it on the same rule the staff got: three random words beats a clever substitution, every time.
Oct 19–23Social engineering, named
Who is really asking? · 20–30 · Staff are doing accounts and identity this week.
- Common Sense's Social Engineering & Online Deception lesson.
- Then project a set of fake DMs and have them name the technique in each one: urgency, authority, flattery, fear. Naming it is what makes it visible later.
- Use examples aimed at their age — free game currency, account recovery scams, fake giveaways, a DM from a “friend” who lost their account.
- Optional: the MFA video and its grades 6–8 Kahoot.
Oct 26–30Deepfakes, and the safe word
Your footprint, and what AI changes · 30 · Staff are doing devices, AI and privacy this week.
- KQED's Above the Noise deepfake episode — free, no login, and it comes with a lesson plan and a viewing guide.
- Then teach the safe word: a family password for a panicked phone call asking for money or a ride. Middle schoolers take this one home and it actually sticks — several staff will hear about it from a parent.
- Common Sense's Grade 8 Deepfakes & Consent lesson goes deeper. Read it before you assign it — it touches image-based harm.
High School · 9–12 · Mr. Sudderth’s building. Send it direct. Self-paced in Classroom, one strong kickoff. Lean on careers. It is one of the few honest 'this is a job you could have' pitches you have.
Ask this today
One question, first two minutes of class. It ties to whatever the staff email said this morning.
Day 1. Ask: name a job in cybersecurity. Most won't know one. That's the hook for this month.
Day 2. The PowerSchool attacker was 19 and got four years. Ask whether that's fair.
Day 3. Ask: you get a Google Doc share notification from a teacher. What do you check first?
Day 4. A district lost $2.3 million because one employee replied to an email. Ask what should have happened instead.
Day 5. Reporting early turns a five-day problem into a five-minute one. Ask why people don't report.
Day 6. Ask: name three things you'd verify by phone rather than email, and say why.
Day 7. Recap: verify out of band. Ask for one example from their own week.
Day 8. Have them run their own email through Have I Been Pwned. The list is the lesson.
Day 9. Attackers don't hack — they type one stolen pair into hundreds of sites automatically. Ask what stops that.
Day 10. Ask: what's the argument against a password manager, and is it a good one?
Day 11. Ask: your password is on a projector at the front of a room for a second. Now what?
Day 12. Recap: password manager, unique everywhere. Ask who set one up.
Day 13. Attackers relayed live 2-step codes at Sudbury and took $12,825. Ask how a second step still failed.
Day 14. Ask: what's a passkey, and why is it harder to steal than a password?
Day 15. Have them open Security Checkup. Ask what they found — almost everybody finds something.
Day 16. Have them open chrome://extensions and count. Ask which ones they'd defend.
Day 17. Recap: audit your own access. Ask who signed a device out.
Day 18. Ask: what's still running on your home wi-fi that nobody has updated in three years?
Day 19. A principal's voice was cloned and the person got four months in jail. Ask what a safe word solves.
Day 20. Ask: you paste a classmate's details into a chatbot to get help. Who else can read that now?
Day 21. Minneapolis had 300,000 files published, including named student case files. Ask what they'd check in their own Drive.
Day 22. Ask what they'd do differently, and which of them is now considering the career.
Oct 1–9The field, and the jobs in it
Spotting fakes · One kickoff plus self-paced · Staff are doing phishing this week.
- Kickoff on the board: cybersecurity is a job market with more openings than people, and it does not require a four-year degree to enter. That pitch lands with this age in a way almost nothing else does.
- Self-paced: CyLab Security Academy. This is where picoCTF went — real capture-the-flag challenges from Carnegie Mellon, free, in a browser, and open year-round rather than only during a competition.
- If you want live machines, apply for the CYBER.ORG Range now — approval can take two business days, so it will not happen spontaneously in week one.
Oct 12–16The exact thing the staff are doing this week
Passwords · Self-paced, one class to set up · Staff are doing passwords this week.
- Walk them through setting up a password manager properly. They will use this in a dorm room in eighteen months — it is a straight life skill.
- Self-paced: run their own email through Have I Been Pwned and their own account through Google Security Checkup, then write up what they found and what they fixed.
- Tell them the staff are doing the identical task this week, for points. Being on the same footing as the adults is most of the appeal.
Oct 19–23Scams built specifically for them
Who is really asking? · 45 · Staff are doing accounts and identity this week.
- Three FTC pages, all free and all current: job scams, task scams (the “earn money doing simple tasks” DMs), and scholarship and financial aid fraud. Seniors are the target market for the third one right now.
- Have them find one real example in their own feed or inbox. They will.
- Coordinate with your counsellors before going near sextortion. It is essential content for this age and it needs a person in the room with a reporting path, not a link on a page.
Oct 26–30What an employer can find
Your footprint, and what AI changes · 45 · Staff are doing devices, AI and privacy this week.
- Have them search themselves and report back. Nothing you say lands harder than what they find.
- Common Sense's Hacking You: Social Engineering & AI — voice cloning, fake account alerts, fraudulent job offers. Forty-five minutes and the most relevant lesson on this list for a senior.
- Then consent and synthetic images of real classmates. Know your discipline policy before you open this, because the conversation goes there. The non-consensual imagery version of this lesson belongs with a counsellor, not on a webpage.
Before you hand any of this to students
Some of this needs a counsellor, not a hyperlink.
Sextortion awareness and the 9–12 lesson on non-consensual synthetic imagery are
essential content for high school, and both need a person in the room with a reporting
path. Do not put either on a page a student clicks alone. Talk to your counsellors
first, and give parents advance notice.
Two resources that used to be on this list are gone.
FBI Safe Online Surfing ended on 1 June 2026 and sos.fbi.gov now redirects — do not
reinstate it. picoCTF has moved to CyLab Security Academy; the old picoctf.org address
is now only a migration notice, so an old bookmark will strand a student.
Common Sense is archiving its older curriculum in December 2026.
Every Common Sense lesson linked here is from their current Digital Literacy
curriculum, not the one being retired. If you go looking for your own, check the
lesson page for an archive warning before you plan around it.
Start the CYBER.ORG Range application now if you want it.
It is free for US 6–12 educators and gives students live Linux and Windows machines in
a browser, but approval can take two business days. It will not happen spontaneously
in week one.
Guest join still works on Kahoot and Blooket — students enter a
code, no account, no data collected. Quizizz has rebranded to Wayground and now wants a
student account, so it is no longer a no-friction option.