Qurexa Logo
Qurexa

Trust. Care. Deliver.

Back to Blog & Insights
Education

66% of schools now bounce back immediately. Only 9% think it is a leadership job

Qurexa Editorial Team1 October 20267 min read 0 0
66% of schools now bounce back immediately. Only 9% think it is a leadership job

What happened

On 1 October 2026, Ofqual published the results of its third annual survey on cyber security in schools and colleges in England, covering the 2025 to 2026 academic year. The headline is encouraging. The share of schools experiencing a cyber incident has fallen to 27%, down from 29% the previous year and 34% in 2023 to 2024. Recovery has improved more sharply. Two thirds of schools, 66%, are now able to recover immediately from an incident, up from 55% the year before. Incidents causing critical damage have fallen to 7%. One question was asked for the first time this year: who is primarily responsible for cyber security? Teachers answered 46% the IT team, 40% all staff, and just 9% pointed to the role played by senior leadership. Amanda Swann, Ofqual's Executive Director of Delivery, welcomed the progress but drew a line under that last figure. 'Cyber security isn't just an IT problem; it's a leadership responsibility,' she said. 'Regular backups and a clear response plan can make a huge difference when things go wrong.' She also pointed out what is at stake in a school specifically: 'a cyber breach can still cause real uncertainty for students if coursework or marks are lost, and staff confidence can be affected long after systems are back online.' The survey includes teachers' own accounts. One described an IT team that spots and tackles attacks in progress. Another credited staff training with preventing harm. Others fared worse: one reported losing network and email access entirely, and another described an incident that led to police closing the school, leaving staff and pupils anxious. More than half of the secondary schools surveyed, 55%, have already taken protective action, such as putting a cyber security policy in place, carrying out risk assessments, and setting up backup and recovery procedures. The survey was run by Teacher Tapp on Ofqual's behalf on 13 July 2026, with 3,775 secondary teachers in England, representing up to 2,162 schools.

Why this matters

Schools hold a surprising amount of sensitive information. Pupil records, safeguarding notes, medical details, free school meal eligibility, staff payroll and exam coursework all sit on school systems. The exam point is the one that worries parents most, and rightly. If coursework or internal marks are lost close to a deadline, the consequence is not an inconvenience for an IT department. It is a young person whose grade is in doubt through no fault of their own. The 9% figure is the real story in this survey. If almost no teachers see cyber security as something senior leaders own, then in most schools the person who can authorise spending, change policy and insist on practice drills is not the person being held responsible. That is a structural problem, and it is exactly the sort of problem that looks fine until the day it does not. There is also a staff wellbeing point that is easy to overlook. Ms Swann's observation that staff confidence can be affected long after systems are back online rings true for anyone who has worked through a serious IT failure. The technical recovery and the human recovery are not the same timeline.

What the evidence actually says

The survey design is worth understanding before reading too much into the numbers. This is a teacher poll, not an audit of school systems. It was run by Teacher Tapp on a single day, 13 July 2026, with 3,775 secondary teachers. Where percentages refer to schools rather than teachers, responses were limited to one per school from the most senior teacher responding, which covers up to 2,162 schools. That method has a clear strength: a large sample and a consistent approach repeated over three years, so the trend is meaningful even if any single number is approximate. It also has clear limits. It reports what teachers believe happened, not what logs show. Teachers may not know about incidents handled quietly by IT staff, which could mean the true incident rate is higher than 27%. Equally, 'recovered immediately' is a judgement, not a measured recovery time. The survey covers secondary schools in England. It does not tell us about primaries, which generally have smaller budgets and less IT support, so the national picture may well be weaker than this. One genuine caution about the falling incident rate: a drop from 34% to 29% to 27% over three years is a real pattern, but attack volumes against the education sector overall have not been falling. It is possible that schools are getting better at prevention. It is also possible that fewer incidents are being noticed or reported. The survey cannot distinguish between those. What is unambiguous is the responsibility finding, because it asks about opinion rather than events. On that measure, 9% is simply what teachers think, and it is a problem.

Practical advice

If you work in a school or college, Ofqual's own three steps are a sensible start. Review: senior leaders should schedule a review with their IT lead. Not an email, a meeting with a date. Plan: download the Department for Education's cyber response plan template, and make sure people know where it is and who does what. Protect: check the school can actually recover if attacked. The Department for Education's Cyber Security Hub sets out what to do. A few additional practical points. Test a restore, not just a backup. A backup nobody has ever restored from is a hope, not a plan. Make sure at least one copy of your data is kept offline or otherwise separated, because ransomware that reaches your network will look for your backups too. Turn on multi-factor authentication for staff email and admin accounts. It is the single highest-value change most organisations can make. Train all staff, not just teachers. Office staff, site teams and governors all have access and all get targeted. If you are a parent, it is reasonable to ask at a parents' evening or governors' meeting what the school's plan is if its systems go down near an exam deadline. The question itself tends to be useful. If your child's school suffers a breach involving personal data, you should be told what happened and what to do. Be alert to scam messages that refer to the incident.

What to know

Ofqual's third annual cyber security survey of 3,775 secondary teachers in England found that 27% of schools experienced a cyber incident in 2025 to 2026, down from 29% and 34% in the two previous years, and that 66% can now recover immediately, up from 55%. Incidents causing critical damage fell to 7%, and 55% of secondary schools have already taken protective steps. The uncomfortable finding is that only 9% of teachers see cyber security as a senior leadership responsibility, which Ofqual's Amanda Swann directly challenged. The survey reflects teachers' perceptions on a single day rather than technical audits, and covers secondaries only. The recommended actions are unglamorous and effective: review with your IT lead, have a written response plan, and test that you can genuinely restore your data. Sources: GOV.UK (Ofqual), 'Schools making strides in cyber security as recovery times improve', 1 October 2026, https://www.gov.uk/government/news/schools-making-strides-in-cyber-security-as-recovery-times-improve; GOV.UK (Department for Education), 'Cyber security: core standard', 16 September 2026, https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/cyber-security-core-standard. This article is for general information and does not replace advice from a doctor, pharmacist or other qualified healthcare professional.

#cyber security#schools#Ofqual#teachers#data#education

Related articles