{"id":234463,"date":"2025-09-11T05:00:00","date_gmt":"2025-09-11T04:00:00","guid":{"rendered":"https:\/\/schoolsweek.co.uk\/?p=234463"},"modified":"2025-09-11T08:30:52","modified_gmt":"2025-09-11T07:30:52","slug":"too-many-school-leaders-still-ignore-cybersecurity","status":"publish","type":"post","link":"https:\/\/schoolsweek.co.uk\/too-many-school-leaders-still-ignore-cybersecurity\/","title":{"rendered":"Too many school leaders still ignore cybersecurity"},"content":{"rendered":"\n

When we started collecting data for The State of School Cybersecurity<\/em> report <\/a> which is published today, one thing became clear: too many schools still don\u2019t have the basics in place to protect themselves.<\/p>\n\n\n\n

The results are sobering. Only half of schools stated having a password policy, fewer than one in six stated having a designated cybersecurity lead, and less than 40 per cent have a cyber incident response plan.<\/p>\n\n\n\n

While multi-factor authentication (MFA) is one of the simplest protections against account compromise, fewer than one-quarter of schools enable it on all supported cloud services.<\/p>\n\n\n\n

As a parent and someone who works with schools daily, this alarms me. Behind every statistic is a classroom, and children whose learning and digital safety could be disrupted if systems are breached.<\/p>\n\n\n\n

And as the Intradev breach reported in these pages this week<\/a> demonstrates, it\u2019s not just pupils who can be adversely affected but staff too, and schools themselves.<\/p>\n\n\n\n

A breach can cancel lessons, leak sensitive safeguarding data, and cost schools millions in recovery. We\u2019ve seen ransomware lock staff out of files mid-GCSE season, and countless schools forced to close due to severe IT outages.<\/p>\n\n\n\n

Yet many leaders still see cybersecurity as an \u2018IT issue\u2019. It isn\u2019t. It\u2019s a leadership issue. The Department for Education expects academy trusts to assign a senior leader responsible for cybersecurity and advises all schools to do the same.<\/p>\n\n\n\n

It\u2019s not hard to see why. Only leaders have the authority to make it a whole-school priority, properly resource it, shape culture to support it, and ensure governors ask the right questions.<\/p>\n\n\n\n

<\/a>The good news is you don\u2019t need to fix everything at once. Cyber resilience builds step by step. Here are three high-impact actions every school can take:<\/p>\n\n\n\n

Prepare and test your cyber \u2018fire drill\u2019<\/strong><\/h3>\n\n\n\n

A cyber incident response plan is only worth the paper it\u2019s written on if you practise it. Imagine the network goes down on Monday morning, who do you call? How do you communicate? What gets prioritised?<\/p>\n\n\n\n

With only 38 per cent stating they have a dedicated response plan, most schools don\u2019t have these answers.<\/p>\n\n\n\n

Run a tabletop exercise to build confidence with your leadership team. Find the gaps before attackers do.<\/p>\n\n\n\n

Patch and scan your systems regularly<\/strong><\/h3>\n\n\n\n

Leaving software unpatched is like leaving a broken lock on your front door. Critical updates should be installed within 14 days, and vulnerability scans should be conducted termly.<\/p>\n\n\n\n

You don\u2019t need to be perfect, just proactive enough that an attacker will move on to an easier target.<\/p>\n\n\n\n

Put cyber on the agenda<\/strong><\/h3>\n\n\n\n

If safeguarding is a standing item at governors\u2019 meetings, why not cybersecurity?<\/p>\n\n\n\n

Only 15 per cent of schools state having a designated cybersecurity lead, and just 10 per cent say senior leadership and governors regularly discuss it.<\/p>\n\n\n\n

Appoint a named senior lead, train them, and make cybersecurity part of your governance cycle. When leadership shows it matters, staff follow suit.<\/p>\n\n\n\n

<\/a>I don\u2019t share these findings to spread alarm; quite the opposite. Our message is that every improvement matters. Each new policy, update or staff conversation builds another layer of defence.<\/p>\n\n\n\n

Think of it like classroom behaviour: consistency matters. If staff know the rules and leadership reinforces them, the culture shifts. Cybersecurity works the same way.<\/p>\n\n\n\n

The threats are real, but so is the progress schools can make. Half of schools suspend accounts promptly when staff leave; that\u2019s simple but powerful. Many are running regular scans. The building blocks are there.<\/p>\n\n\n\n

Now, the challenge is to move from piecemeal action to whole-school resilience. That takes leadership.<\/p>\n\n\n\n

<\/a>Cybersecurity isn\u2019t someone else\u2019s job. It\u2019s everyone\u2019s. Leaders, governors and staff alike. Because what\u2019s really at stake isn\u2019t data or devices. It\u2019s learning. It\u2019s children.<\/p>\n\n\n\n

If schools can take one lesson from this year\u2019s report, it\u2019s that resilience is built decision by decision. Start today. Make MFA the norm. Test your plan. Put cyber on the agenda.<\/p>\n\n\n\n

The attackers aren\u2019t waiting, and neither should we.<\/p>\n\n\n\n

Read The State of School Cybersecurity<\/em> report in full <\/strong>here<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Our new ‘State of school cybersecurity’ report is deeply concerning given recent widely-reported breaches<\/p>\n","protected":false},"author":311124,"featured_media":75543,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"footnotes":""},"categories":[6],"tags":[],"post-theme":[3634],"class_list":["post-234463","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-opinion","post-theme-opinion-edtech"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t