Cyber security for schools, academies and trusts across the UK
Schools are now one of the most targeted organisations in the country. We help you get ahead of the threat with practical, education-focused cyber security that protects pupils, staff and your school’s reputation, without jargon and without scare tactics.
The numbers every school leader should know
The UK Government’s Cyber Security Breaches Survey 2025/2026 (DSIT and Home Office, published April 2026) found:
- 73% of secondary schools identified a cyber breach or attack in the last 12 months, up from 60% the year before.
- Almost half of primary schools (49%) did the same. Only 43% of UK businesses reported a breach.
- 1 in 5 secondary schools is attacked at least weekly, and around 1 in 10 at least daily.
- Phishing was involved in 90% of primary and 96% of secondary school breaches.
- Only 45% of primary schools and 62% of secondary schools have a policy to apply security updates within 14 days.
- Just 14% of primary and 23% of secondary schools have acted on all of the NCSC’s 10 Steps to Cyber Security.
- Around 1 in 3 school IT leads did not know whether their school had cyber insurance.
The good news: the same survey shows schools take cyber security seriously at leadership level. What is usually missing is time, specialist skills and someone to turn good intentions into a plan. That is where we come in.
Meeting the DfE cyber security standard by 2030
In England, the Department for Education expects every school and college to meet its six core digital and technology standards by 2030, including cyber security and filtering and monitoring. The cyber security standard was updated in 2026 to reflect the NCSC’s latest Cyber Essentials requirements. Schools in Scotland, Wales and Northern Ireland face the same threats and the same NCSC guidance, and we support them too.
How we help
- Cyber security audit and action plan mapped to the DfE standard, Cyber Essentials and the NCSC 10 Steps, with a clear, prioritised roadmap your governors can follow.
- Cyber Essentials readiness: patching, MFA, admin rights, secure configuration and firewalls brought up to standard.
- Backup and disaster recovery: tested, offline or immutable backups and a recovery plan that has actually been rehearsed.
- Microsoft 365 and Google Workspace security: conditional access, MFA for staff and, where appropriate, pupils, plus email protection against phishing and impersonation.
- Staff and pupil training that people actually remember, including phishing simulations and short, practical sessions.
- Incident response planning so everyone knows who does what, who to call and when to report.
- Governor and SLT reporting in plain English, so cyber risk sits properly on your risk register.
- Supplier and data protection checks, including DPIAs for new systems and AI tools.
Why schools choose Trust IT Group
- We have worked in and alongside schools for decades. We understand safeguarding, exams, budgets and term-time pressure.
- We work with your existing IT team or provider, not against them. Many schools use us as their specialist escalation partner.
- We give honest, independent advice. If you do not need to spend money, we will tell you.
- We now support schools, academies and multi-academy trusts across the whole of the UK, on site and remotely.
Frequently asked questions
What is the DfE cyber security standard for schools?
It is one of the DfE’s six core digital and technology standards that schools in England are expected to meet by 2030. It covers areas such as protecting devices and accounts, MFA, security updates, backups, training and incident response, and was updated in 2026 to reflect the latest Cyber Essentials requirements.
Do schools need Cyber Essentials?
Cyber Essentials is not compulsory for schools, although it is required for colleges under their funding agreement. Its five technical controls are an excellent baseline, and working towards it closely supports the DfE cyber security standard.
What are the biggest cyber risks for schools?
Phishing is by far the most common, involved in 96% of breaches at secondary schools. Other risks include impersonation emails, compromised accounts, unpatched systems, ransomware and weak supplier security.
How quickly can you help after a cyber incident?
Contact us straight away. We can help contain the incident, restore systems, work with your insurer and report correctly. Better still, we’ll help you prepare an incident response plan before you need one.
Not sure where to start? Give us one day in your school and we’ll show you where money is being wasted and where risk is hiding. Book your IT review day →
Related services
Start with a conversation
Not sure where your school stands? Get in touch for a no-obligation chat. We will talk through your current set-up, highlight any urgent risks and suggest sensible next steps, whether or not you work with us.
Talk to us about your school’s cyber security →
Stay up to date every week
Sign up to School IT Intelligence, our free weekly briefing for school IT teams and leaders covering the latest threats, Microsoft 365 changes, safeguarding and practical tips. Want to build your own team’s skills? Ask us about the School IT Academy, our online cyber security and technical training for school IT staff.
Statistics source: Cyber Security Breaches Survey 2025/2026: education institutions findings, GOV.UK, Crown copyright, Open Government Licence v3.0.