Relying solely on ad hoc efforts to manage school cybersecurity risk is like playing football without a helmet.