BOARDING SCHOOL BOOSTS CYBERSECURITY AND RANSOMWARE RESILIENCE
OVERVIEW
Winchester College had already built a strong cybersecurity foundation, yet the IT team remained concerned about what might happen if those defences were breached. Seeking a low-cost, easy-to-use, yet highly effective solution, the school turned to BullWall’s Ransomware Containment technology to act as a critical last line of defence.
CHALLENGES
Safeguarding pupils is a top priority for any school, and in today’s digital age, this responsibility becomes more complex. At Winchester College, around 1,000 users—including both students and staff—access the school’s network through Microsoft Surface tablets, Office 365 accounts, and up to five personal devices per student. This highly connected environment is supported by a fibre-optic and wireless network with approximately 500 access points, a few of which are hardwired.
“We are proud of what we have achieved in terms of developing a progressive digital environment for our learners,” says Lawrence Beech, Director of IT at Winchester College.
However, maintaining a secure yet open network is challenging—especially for a boarding school where technology is used beyond the classroom for everything from homework to staying in touch with family.
While the school’s perimeter is protected by next-generation firewalls and multiple security solutions, its IT staff does not operate around the clock, even though threats can arise at any time.
“In effect, we are in loco parentis to our pupils because the boys board at Winchester College, so it is both school and home for them. As well as using their tablets for learning and things like homework in the evenings, they also need to use mobiles and laptops and the Internet to communicate with family.”
THE SEARCH FOR A SOLUTION
Despite its robust security setup, Winchester College began exploring how it could further strengthen its defences—particularly against ransomware.
“Most security applications at the time were about perimeter defence and stopping the bad actors at the door,” says Beech. “If I look at large corporations that spend millions on cybersecurity and get breached it tells you it is a question of when, not if. We can’t spend millions on perimeter defences that we know are going to be breached. We take every precaution we can, but what do we do when we are breached? How do we manage and prepare for that event?”
The worry, says Beech, was how long it would take to detect and recover from an incident— and whether the school would be prepared.
The school needed an affordable and practical solution that would help them respond during an attack, not just prevent one.
That’s when Winchester College discovered BullWall Ransomware Containment—a solution that struck the right balance between effectiveness, cost, and usability.
“Some competing products offered similar capabilities but were priced far beyond what a typical school could justify,” Beech adds. “BullWall was different. It was simple to use, easy to deploy, and provided exactly what we needed.”
If I look at large corporations that spend millions on cybersecurity and get breached it tells you it is a question of when, not if.
IMPLEMENTATION AND RESULTS
Oliver Webb, Head of Infrastructure, was particularly impressed with BullWall’s ability to detect and stop ransomware in real time—even after the threat has breached traditional defences.
“It was the only solution we found that could actively halt an attack mid-process, identify the threat, and shut it down,” says Webb.
Deployment was fast and seamless. It took just two hours to install the system on a central server, after which BullWall Ransomware Containment entered “learning mode” to understand normal user and system behaviour. Within two weeks, the solution was live, protecting all on-premise data. Plans are now underway to expand coverage to applications like SharePoint.
“One of BullWall’s biggest advantages is that it only needs to be set up on a single server,” explains Webb. “There’s no need to configure endpoint clients, user policies, or install anything on individual devices.”
Since going live, the system has flagged a few unusual behaviours—such as users saving encrypted email attachments to shared drives—but these were quickly confirmed as false positives. Each alert is investigated, and legitimate activity is added to BullWall’s exception list to prevent unnecessary shutdowns.
BENEFITS AND PEACE OF MIND
“The biggest benefit is peace of mind,” says Webb. “You can go home at the end of the day knowing BullWall is monitoring everything. If something happens, it will identify it, act immediately, and shut it down—faster than we ever could.”
In addition to protection, BullWall’s Ransomware Containment has helped the IT team gain deeper insights into how files and systems are being used. It provides a detailed flowchart of any flagged activity, helping the team analyse incidents and improve overall system efficiency and user behaviour.
“BullWall’s real value is hard to quantify,” Beech reflects. “Because if it does its job, we never actually see the full impact. But if an attack does happen, it’ll be worth its weight in gold.”
Support has also exceeded expectations. On one occasion, after a minor alert late on a Friday, the team was quickly connected to BullWall’s Chief Technology Officer via Teams—who personally helped investigate and resolve the issue.
“We’ve even learned new things about our network just from reviewing BullWall’s alerts. It’s helped us understand user behaviour and strengthen our systems overall,” says Webb.
“Ultimately, it lets you sleep better at night. And that’s invaluable.”
You can go home at the end of the day knowing BullWall is monitoring everything. If something happens, it will identify it, act immediately, and shut it down—faster than we ever could.
