Questions, answered plainly

None. Everything is written in plain English with a recommended action beside it. If you can read your readiness score you can use Ceidwad. The technical detail is there when your IT team wants it, and never required to get value from the page.

Through each provider's own read-only connection. Today that means Microsoft 365, Microsoft Defender, Microsoft Entra ID and Sophos Central. Ceidwad reads your posture, explains what it finds and prepares fixes for you to approve — it does not change your settings on its own. Setup takes under an hour.

Not for the Microsoft connectors. They run cloud to cloud, so nothing is installed and no ports open. A connector reading from equipment on your own network may need one address allowed, and we tell you exactly which if it applies to you.

Yes, and the authority stays with the school. Ask your provider to make the one-time read-only connection, or make it yourself if you hold admin consent. Either way you can see every connection in your own account and remove any of them whenever you like. Responsibility for cyber security sits with the school and its governors, and Ceidwad gives you the oversight to hold a provider to account rather than take their word for it.

No. Ceidwad does the watching, the compliance tracking and the translating, so an IT lead or a leadership team can decide without being security specialists. It sits alongside whoever runs your IT and does not replace them.

No. We do not ingest your logs, we do not watch your network in real time and we will not ring you at three in the morning. Ceidwad makes sense of where you stand and what to fix next. Live monitoring and response stay with your managed provider or with Microsoft.

No. Ceidwad does not sit on your devices and does not block anything — that is Defender's job, or Sophos's. Ceidwad reads what they report and tells you whether they are actually configured to protect you, which is a different and frequently unanswered question.

No. Ceidwad does not probe, scan or attack anything. It reads the posture your existing tools already report, and the public DNS and certificate records anyone can read. Nothing is intrusive and nothing needs a testing window.

No. Safeguarding stays with your DSL and Ceidwad is not part of your KCSIE obligations. Pupils are not users of Ceidwad and are never targeted by a phishing simulation or a drill.

Core platform data at rest sits in Microsoft Azure UK South, encrypted in transit and at rest, with a separate encryption key for each school. Some third-party services, including AI processing where it is enabled, may involve processing outside the UK under contractual safeguards. We hold the least we need to assess your posture. Our security page and privacy policy set out the detail, and your data protection officer is welcome to review our processing terms.

Yes. A trust gets a central view with every academy scored on its own and rolled into one aggregate, so oversight does not mean signing into eleven systems. Pricing is per academy on a single invoice.

We do not certify anyone, and we will not display a badge we have not earned. What we do is track your readiness against it continuously and prepare the evidence, so certification becomes an afternoon rather than a project.