UK schools are getting better at incident recovery, although major gaps in cybersecurity capability still exist across the sector, according to new government data.
The government’s Office of Qualifications and Examinations Regulation (Ofqual) released new figures on October 1 to coincide with Cyber Security Awareness Month.
It revealed that the share of schools experiencing a cyber incident has fallen consistently over recent years: from 34% in 2023-24 to 29% in 2024-25 and 27% for 2025-26.
When incidents take place, two-thirds (66%) of schools are now able to recover immediately, up from 55% in the prior academic year. Critical damage from attacks has also fallen, down to 7%.
Read more on education sector cyber risk: Cyber-Attacks Surge 63% Annually in Education Sector
“It’s encouraging to see schools recovering faster, but a cyber breach can still cause real uncertainty for students if coursework or marks are lost, and staff confidence can be affected long after systems are back online,” said Ofqual executive director of delivery, Amanda Swann.
“Cybersecurity isn’t just an IT problem; it’s a leadership responsibility. Regular backups and a clear response plan can make a huge difference when things go wrong.”
However, the data revealed that, for a plurality of schools, cybersecurity is in fact still treated as a problem solely for the tech team.
Asked who is primarily responsible for cybersecurity, nearly half (46%) of responding teachers said their IT team, 40% said all staff, and only 9% claimed senior leadership played a role.
Cyber Resilience Still Uneven
This might explain why many schools are still failing to prioritize cyber initiatives.
Although over half (55%) of the secondary schools surveyed claimed to have already taken action to protect against cyber-attacks, that leaves a significant share that have yet to put in place measures such as implementing a cybersecurity policy, carrying out risk assessments, and setting up backup and recovery procedures.
Mat Pullen, director for education at Jamf and a former secondary school teacher and university lecturer, said it’s encouraging that the sector is improving cyber resilience.
“Reducing incidents matters, but so does recovering faster,” he added. “Cyber-attacks have closed schools for a week or longer in the past, further disrupting an education sector already hit by Covid and affecting the wider economy as parents take time off work.”
However, he expressed concern over the 45% of schools yet to take preventative action.
“Schools need to immediately assess their risks – only by understanding what types of threats affect the items in their networks can they properly address the problem,” Pullen argued.
“Schools should then build an internet safety framework, including content filtering to block inappropriate material and threat prevention software to stop cyberattacks.”
Cybersecurity should be a responsibility shared between IT, teachers and senior leadership, he added, claiming: “breaking down these silos keeps technology secure and lessons running.”
Some 2162 schools and 3775 teachers were surveyed for the Ofqual study.