New data from Ofqual has revealed that schools and colleges across England are making progress in cybersecurity training but are struggling to recover quickly from attacks when they occur.
Ofqual is now urging education institutions to enhance their cyber training and ensure they are protected from malicious software, as well as have backups in place to restore students’ coursework and other vital systems in the event of an attack.
This comes in light of Cybersecurity Awareness Month this October, which is dedicated to raising public awareness about cyber threats and encouraging people and organisations to adopt practices that protect against cyber-attacks.
Key actions promoted during this month include using strong passwords, enabling Multi-Factor Authentication (MFA), updating software regularly, and recognising and reporting phishing attempts.
Facts and figures: Cyber training rises by 11 percentage points
The proportion of teachers who received cybersecurity training has increased by 11 percentage points, from 61% during the academic year 2023 -2024 to 72% in 2024-2025.
However, the time taken for schools to recover from cyber incidents has worsened – 55% of schools that experienced a cyber incident were able to recover immediately, compared to 63% the previous year.
Amanda Swann, Ofqual’s Executive Director of General Qualifications, explained: “Cyber-attacks can have a devastating impact on students’ academic work. Schools and colleges experiencing cybersecurity incidents reported losing entire classes’ coursework and facing weeks of disruption to teaching and learning.”
The impact of critical damage from cyber-attacks
The poll also found that 29% of schools experienced a cybersecurity incident in the past academic year, a slight decrease from 34% previously.
Despite this modest reduction in prevalence among those surveyed, the severity of the impact was greater, with 10% of schools reporting critical damage from cyber-attacks, up from 6% the previous year.
Teachers described the real-world consequences of cybersecurity attacks. One educator reported how an incident affected an entire academy trust, forcing staff to recreate lost schedules and resources.
Moreover, another teacher reported having suffered an attack, describing it as ‘awful for students’ coursework and staff planning, some things were gone forever’.
Maintaining effective defences against cybersecurity threats
Amanda Swann concluded: “Protection from malware and regular data backups are the most effective defence against these threats. Schools that maintain current, accessible backups can restore systems more quickly and avoid ransomware demands.
“As schools become increasingly digital, robust cybersecurity measures protect both educational continuity and students’ academic futures.”
For practical tips on how to defend against cyber-attacks, visit the National Cyber Security Centre’s Small Business Guide to Cybersecurity.
