"It’s encouraging to see schools recovering faster, but a cyber breach can still cause real uncertainty for students if coursework or marks are lost, and staff confidence can be affected long after systems are back online," said Ofqual executive director of delivery, Amanda Swann.
Ofqual figures: incident prevalence and recovery rates
New figures released by the Office of Qualifications and Examinations Regulation (Ofqual) on October 1, timed to coincide with Cyber Security Awareness Month, show a steady decline in the share of UK schools reporting cyber incidents. The proportion fell from 34% in the 2023–24 academic year to 29% in 2024–25 and 27% in 2025–26. When incidents occur, schools are also recovering more quickly: two‑thirds (66%) of schools said they were able to recover immediately, up from 55% in the prior academic year. The share reporting critical damage from attacks has fallen to 7%.
Who is treating cybersecurity as whose responsibility?
The Ofqual survey reveals an enduring division over who owns cybersecurity inside schools. Nearly half of responding teachers (46%) said the IT team was primarily responsible; 40% said responsibility fell on all staff; and only 9% said senior leadership played a role. That plurality of answers suggests many schools still see cyber resilience as a technical problem centred on IT teams rather than an institutional leadership challenge.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePreventative action: progress and persistent gaps
Among secondary schools surveyed, just over half (55%) reported having taken action to protect against cyber-attacks. That leaves a substantial minority—45%—that have yet to implement measures the survey highlights as basic elements of cyber resilience, such as a formal cybersecurity policy, risk assessments, and explicit backup and recovery procedures. Ofqual’s executive director Amanda Swann stressed the practical difference those elements can make, urging regular backups and a clear response plan to reduce harm when incidents occur.
Voices from education technology: urgency and practical steps
Mat Pullen, director for education at Jamf and a former secondary school teacher and university lecturer, described the sector’s improving recovery posture as "encouraging" while warning that prevention remains incomplete. He noted that cyber-attacks can close schools for a week or longer, compounding disruption from prior events such as Covid and affecting the wider economy when parents take time off work. Pullen urged immediate risk assessments to identify the threats that matter for the specific devices and services in a school’s network, and recommended building an internet safety framework that includes content filtering and threat‑prevention software.
What this means for IT teams, senior leaders, and secondary schools
- IT teams and technologists: The data show improved recovery capability but also concentrated responsibility. IT teams will likely remain operationally central—handling backups, incident response, and technical controls—while also facing pressure to make recovery processes transparent to non-technical staff.
- Senior leaders and school governors: With only 9% of teachers saying senior leadership is primarily responsible for cybersecurity, leadership teams face a clear governance gap. The Ofqual findings and Swann’s emphasis on leadership responsibility point to a need for senior leaders to adopt clear policies and ensure oversight of risk assessments and recovery plans.
- Secondary schools and teachers: More than half have taken protective steps, but 45% have not. Teachers who reported IT as the primary owner of cybersecurity may continue to see technical staff respond to incidents, yet the survey suggests broader staff engagement and training are necessary to protect coursework, marks, and continuity of lessons.
The Ofqual dataset—collected from 2,162 schools and 3,775 teachers—paints a sector that is clearly improving its ability to bounce back from cyber incidents but remains uneven in prevention and governance. Faster recovery reduces immediate disruption, yet the persistence of schools that have not implemented basic safeguards and the low share of senior leaders claiming ownership leave open a pressing institutional question: will improved recovery translate into systematic risk reduction led from the top, or will responsibility remain siloed within IT teams?
Read the original Ofqual findings at https://www.infosecurity-magazine.com/news/uk-schools-recovering-faster/.
