With online training platforms becoming increasingly commonplace for businesses across the US and beyond, it’s sadly unsurprising that they’ve attracted the attention of bad actors. The more businesses adopt online learning, the broader the attack surface becomes, meaning threats become more prevalent.
In general, according to Gus Mallett for Tech.co, the US education sector is under increasing threat from cybercriminals, with a more than 40 percent increase in suspicious activity surrounding educational bodies and platforms in the first half of 2025 alone.
Hackers attacking learning platforms have access to a wealth of sensitive data they can exploit. Not only is there personally identifiable information, but also financial data, educational modules, and company secrets that could cause genuine harm if leaked.
The Increasing Cybersecurity Challenges Facing Online Learning Platforms
Across all industries, cybersecurity incidents are becoming more prevalent and more sophisticated. However, there are largely three main threats facing online platforms (and the broader education sector):
- Phishing, where users and trainers can inadvertently grant access to sensitive systems, believing requests are genuine.
- Ransomware, where hackers deploy malicious software to lock down systems until a ransom is paid. This can be highly effective, with more than half of businesses electing to pay such ransoms. For companies, losing access to learning platforms can stultify training programs and lead to compliance and legal issues.
- DDoS attacks, through which bad actors render online platforms unusable by overloading them with malicious requests.
All three of these common threats can interrupt company operations, put user data at risk, and potentially risk reputation and revenue.
Learning system providers (and trainers who use them) have a duty of care to ensure that learner data is as protected as possible against these threats. Ultimately, innocent learners could lose money and privacy through breaches beyond their control.
Of course, companies that need to meet compliance requirements within industry regulations will also need to safeguard sensitive information as much as possible. Not taking action to prevent hacking or data breaches could put firms at risk of heavy fines and reputational damage.
Common Security Vulnerabilities in Online Training Environments
It is not always simple to know where to look for hackers’ inroads into learning systems. Therefore, many companies invest in procedures such as penetration testing, which can help to uncover hidden weaknesses that can be tightened up to ensure their security postures are more robust.
Some typical security weaknesses that befall learning systems and their users include:
- Poor access controls, such as weak passwords, insufficient security measures (such as a lack of multi-factor authentication), and poor security policies, outright.
- Insufficient security knowledge, for example, where trainers and users fail to log out of systems properly, share passwords, or don’t follow best practices as advised.
- Outdated systems and software, where bugs and code errors can provide easy backdoor access for hackers to break in and wreak havoc. If a company fails to update its learning systems to the latest versions, for example, attackers can exploit weak and undeveloped code.
- Insider concerns and threats, which, while seemingly improbable, occur more regularly than many assume. It’s estimated that around 60% of data breaches occur because of insider threats, and that this number is rising.
For companies and trainers using wholly online, portal-based training systems, the biggest risks to consider are access controls and poor security knowledge.
Practical Security Best Practices Trainers Can Implement
Although wider security for learning platforms will fall to IT specialists and cybersecurity staff, there are practices that trainers can follow to ensure they are doing their bit. For example, they could:
- Tighten up access controls (ensure they and any users have secure passwords and are using multi-factor authentication)
- Report issues and suspicious requests as they emerge (knowing who to report to in the security chain of command and taking immediate steps to lock down areas of concern)
- Limit data access (ensuring only authorized users have access to the modules and data they need)
- Ensure all users and trainers are aware of security practices (sharing best practices with fellow trainers and users on how to look after their own data)
- Back up data regularly (saving important documents and understanding how to restore them whenever needed)
- Refresh security policies and controls across the year (working with security teams and professionals to feed back on security practices, and to share new processes with users and other trainers)
Preparing for and Responding to Security Incidents
It’s thought that fewer than half of all companies have an incident detection and response plan in place. Avoiding these measures when running an online learning platform harms your ability to bounce back in the event of a breach or hacking incident.
At the very least, companies running online learning platforms and modules should have a flexible incident response plan in place. That should, ideally, focus on helping trainers and users understand how to spot security issues, contain problems when possible, and quarantine or eradicate them (if they have the authority to do so).
Ultimately, a reliable incident response plan should keep everyone in the chain directly informed about what’s occurring and who has what responsibilities. For example, trainers should be able to communicate directly with security and IT personnel to learn how to identify and eradicate threats.
Building a Culture of Security Awareness Among Learners and Trainers
Above all else, to keep learning systems secure and protected against evolving threats, both learners and trainers need to respect security protocols. Building a culture of security awareness means ensuring everyone understands the ramifications of poor security hygiene and that everyone has individual responsibility for what they access and how they access it.
Creating a culture of security awareness among all platform users is as easy to kick-start as ensuring best practices are made available through training. However, maintaining that culture is essential, meaning users and trainers should regularly top up on knowledge wherever possible to keep their companies robust.
