Two thirds of schools can now bounce back the same day
What happened
On 1 October 2026, the Department for Education published findings from Ofqual's third annual cyber security survey, covering the 2025 to 2026 academic year. The direction of travel is good, and the headline figure most worth repeating is about recovery rather than attacks. Two thirds of schools - 66% - said they could recover immediately from a cyber incident. A year earlier that figure was 55%. Cyber incidents themselves are falling. In 2025-26, 27% of schools reported one, down from 29% the year before and 34% in 2023-24. Seven per cent said an attack caused critical damage. Among secondary schools, 55% had protective measures in place. The survey also asked who is primarily responsible for keeping school systems safe. The answers show no settled view: - the IT team: 46% - all staff: 40% - senior leadership: 9% The research was carried out by Teacher Tapp on 13 July 2026, with responses from 3,775 secondary teachers and up to 2,162 schools - one response per school, from senior staff. Amanda Swann, Executive Director of Delivery at Ofqual, welcomed the progress but added a caution: "It's encouraging to see schools recovering faster, but a cyber breach can still cause real uncertainty." She was blunter about the responsibility question: "Cyber security isn't just an IT problem; it's a leadership responsibility." Schools are pointed towards a three-step approach - Review, Plan, Protect - using the Department for Education's cyber response plan template and its Cyber Security Hub.
Why this matters
Schools hold a remarkable amount of sensitive information about children. Safeguarding records, special educational needs plans, medical details, free school meal eligibility, addresses, photographs, parents' contact details and bank information for trips and lunches. They also run on systems that cannot simply pause. Registers, timetables, exam entries, coursework, communications with parents. When a school loses access to those, teaching does not stop politely while IT is fixed. Staff improvise, deadlines slip, and exam evidence can be at risk. That is why the recovery figure is the right thing to celebrate. You cannot prevent every incident. You can decide in advance how fast you get back up. Going from 55% to 66% able to recover immediately is a large shift in one year, and it almost certainly reflects dull, unglamorous work: better backups, tested restore procedures, written response plans. The 9% figure is the uncomfortable one. Fewer than one in ten schools see cyber security as sitting primarily with senior leadership. Yet the decisions that matter most - whether backups are funded, whether staff training happens, who gets rung at 7am when systems are down - are leadership decisions, not IT ones. That is what Amanda Swann's second quote is getting at. Attackers do not usually break in through clever code. They get in because someone clicked a link, reused a password, or because an old account was never closed. Those are organisational problems.
What the evidence actually says
A few things to keep in proportion. This is a teacher survey, not a forensic audit. It records what senior staff reported, which depends on what they know about and how they define an incident. Some of the fall from 34% to 27% could reflect better prevention; some could reflect differences in reporting. A single year's movement is interesting, three years in the same direction is more persuasive. The sample is weighted towards secondary. There were 3,775 secondary teacher responses and up to 2,162 schools represented, one per school. Primary schools, which often have far less IT support, may face a different picture. "Recover immediately" is a self-assessment. Schools that have never had to test their backups under pressure may be more confident than their systems deserve. The only reliable way to know is a practice restore. Seven per cent reporting critical damage is not a small number. Applied across thousands of schools, that is a great many disrupted terms. And the responsibility question asked who is "primarily" responsible. The 40% answering "all staff" is not wrong - good security does depend on everyone. The concern is the 9% for senior leadership, because responsibility that sits nowhere specific tends to be nobody's job when it matters.
Practical advice
For school leaders and governors, the survey's own Review, Plan, Protect framing is sound: 1. Review. Put a meeting with your IT lead in the diary this term. Ask three questions: when did we last restore from a backup to check it works, which staff and former staff still have access, and who do I ring at 7am on a Monday if systems are down. 2. Plan. The Department for Education publishes a free cyber response plan template. Use it. A plan that exists on paper and has been read by the people named in it is worth more than an expensive tool nobody has configured. 3. Protect. The DfE Cyber Security Hub collects the current guidance in one place. Governors should ask for cyber security to appear on the risk register with a named owner at leadership level, not just in the IT report. For teachers and support staff: - Use a unique password for school systems, and turn on multi-factor authentication where it is offered. - Treat unexpected emails about invoices, payroll or urgent requests from senior staff with suspicion, even if the name looks right. - Report a suspected click immediately. Speed of reporting is what limits damage, and nobody should be made to feel stupid for owning up. For parents: if a school tells you its systems are down, be patient with slower communication - and be sceptical of any message asking you to pay for trips or dinners through a new account.
What to know
Findings from Ofqual's third annual cyber security survey, published on 1 October 2026, show 27% of schools reported a cyber incident in 2025-26 - down from 29% the previous year and 34% in 2023-24. Recovery has improved markedly: 66% of schools say they could recover immediately, up from 55%. Seven per cent reported critical damage from an attack, and 55% of secondary schools had protective measures in place. Asked who is primarily responsible for cyber security, 46% said the IT team, 40% said all staff, and only 9% said senior leadership - a gap Ofqual's Amanda Swann challenged directly: "Cyber security isn't just an IT problem; it's a leadership responsibility." The survey was conducted by Teacher Tapp on 13 July 2026 with 3,775 secondary teachers across up to 2,162 schools. Schools are pointed to the Department for Education's cyber response plan template and Cyber Security Hub. Sources: Department for Education, "Schools making strides in cyber security as recovery times improve", 1 October 2026, https://www.gov.uk/government/news/schools-making-strides-in-cyber-security-as-recovery-times-improve ; GOV.UK education and skills news listing for 1 October 2026, accessed 5 October 2026, https://www.gov.uk/search/news-and-communications?order=updated-newest This article is for general information and does not replace advice from a doctor, pharmacist or other qualified healthcare professional. For school cyber security guidance, use the Department for Education's own published resources.
Related articles
Mondays, Wednesdays and Fridays: the hub that opened at a football ground
On 12 October 2026, the Department for Work and Pensions announced that a new Youth Hub had opened in Exeter. The hub is for people aged 16 to 24. It is at St…
A 'veneer of progress'? The youth justice chief answers her critics
On 12 October 2026, the chief executive of the Youth Justice Board for England and Wales published an article defending the approach that now shapes how the sys…
Three years of missing accounts, and two trustees on the register
On 12 October 2026, the Charity Commission announced that it has opened a statutory inquiry into an education charity called Crossfields Institute. The charity…