This session opens with a real, live cyberattack demonstration by a former penetration tester, built from the tactics attackers actually use against schools and public sector networks today. Then we cross over to the defense side. Using modern endpoint detection and response (EDR) and a SOC as a service (SOCaaS) approach, we'll show what it looks like to detect, contain, and respond to that same attack in real time, and how the MITRE ATT&CK framework becomes a practical tool your team can utilize. Whether you're building a security program from scratch or modernizing what you already have, you'll leave with a clear, real world picture of both sides of the fight, and what it actually takes to defend a K-12 or public sector network against today's threats.