Schools have always had to deal with cyber risk, but what is changing is how the attacks happen.
For years, many people thought of school cyber security as antivirus, passwords and stopping ransomware. Those things are still important, but the latest education threat research from Huntress shows a more awkward reality.
Attackers are not always trying to smash the front door down. Increasingly, they are trying to look like they belong there.
They are abusing trusted remote support tools. They are logging in with stolen or tricked credentials. They are manipulating mailboxes. They are using social engineering to get staff to follow instructions that appear normal. In some cases, they are preparing the ground for ransomware days before the final disruption happens.
For UK schools, academies and multi-academy trusts, this matters because the systems attackers are targeting are often the same systems schools rely on every day: Microsoft 365, email, remote support tools, cloud storage, safeguarding platforms, finance systems and admin devices.
Education is not a low-interest target
One of the strongest points in the report is that education is not being targeted by accident.
Schools and trusts hold sensitive pupil, parent and staff data. They depend heavily on cloud systems, shared files, email, remote access and third-party platforms. They also have very little room for downtime.
If a school loses access to key systems, the impact is not just technical.
It can affect lessons, attendance, safeguarding, SEND support, payroll, finance, parental communication and senior leadership decision-making.
That is why school cyber security should not be treated as a purely IT issue. It is part of operational resilience. It is part of governance. Increasingly, it is also part of safeguarding.
1. Remote support tools are now part of the risk
Remote monitoring and management tools, often called RMM tools, are widely used in IT support. They are not bad tools, in fact, they are often essential, especially for multi-site schools and trusts. They allow IT teams and providers to support machines, fix problems, install updates and manage devices without being physically on-site.
The problem is that attackers know this too.
The Huntress report highlights a 277% year-on-year rise in malicious RMM use in 2025. It also says malicious RMM use accounted for 24% of all observed incidents.
That should make schools pause, not panic, pause.
If a remote support tool is being used by the right person for the right reason, that is normal. But if an attacker gets access to it, or installs their own remote access tool, it can give them a very convenient route into the network.
From a school perspective, this raises some useful questions:
- Which remote access tools are installed across your school or trust?
- Who is allowed to use them?
- Are old tools still present from previous IT providers?
- Can you spot unusual remote access activity?
- Is anyone watching outside normal school hours?
This is especially important for MATs, where one weakness can potentially create wider trust-wide risk.
2. Identity is now one of the main attack paths
Attackers do not always need to hack their way in.
Sometimes they just log in.
That is one of the biggest changes in modern cyber security. A stolen password, tricked MFA approval, stolen session token or malicious cloud application can give an attacker access without setting off the sort of alarms people used to expect.
The Huntress report points to identity-based attacks involving MFA fatigue, token theft, OAuth abuse, adversary-in-the-middle techniques and mailbox manipulation.
In plain English, that means attackers may try to:
- trick staff into approving a sign-in request
- steal access after a user has already signed in
- connect a malicious app to a cloud account
- create hidden mailbox rules
- forward emails outside the organisation
- use a real account to send convincing internal phishing emails
For schools, Microsoft 365 identity protection is now critical.
A compromised account might expose email, OneDrive, SharePoint, Teams, safeguarding conversations, finance information and files shared across departments.
This is why MFA is important, but MFA alone is not the whole answer.
Schools also need to monitor what accounts are doing after login.
3. Social engineering is still working
There is a lot of talk about advanced cyber attacks.
Some attacks are advanced.
Many are just manipulative.
The Huntress report highlights ClickFix as one of the key attacker techniques seen in 2025, accounting for 53% of malware loader activity. ClickFix-style attacks are designed to make people follow instructions that seem routine, such as copying and pasting commands, completing fake checks or responding to prompts that appear legitimate.
That is a problem in schools because staff are busy.
They are teaching, safeguarding, answering parents, dealing with behaviour, covering absence, chasing paperwork and trying to keep the day moving.
Attackers know that.
Good security awareness training should not be about catching staff out. It should be about making the safe thing easier to do.
Staff need to know:
- how to spot unusual requests
- how to report suspicious emails quickly
- why MFA prompts should not be approved without thought
- why fake browser messages and pop-ups can be dangerous
- who to ask when something does not feel right
The aim is not fear.
The aim is confidence.
4. Ransomware is still a threat, but the warning signs often come earlier
Ransomware is still one of the most disruptive risks facing schools.
But the attack chain has changed.
The Huntress report says ransomware accounted for 5% of observed incidents in 2025, but it also highlights something more useful for defenders: 17% to 21% of ransomware incidents showed identity-related precursor activity 7 to 14 days before deployment.
That is important.
It means the ransomware event may not be the start of the attack.
It may be the end of it.
Before files are encrypted, attackers may have already:
- stolen or abused credentials
- accessed accounts
- used remote access tools
- moved through systems
- looked for backups
- staged data for theft
This is where managed detection and response can help.
If you only focus on stopping the final ransomware payload, you may miss the quieter warning signs that come first.
What this means for UK schools and MATs
The practical lesson is simple – schools need layered protection.
Not because cyber security needs to be complicated, but because attacks do not arrive through one neat route.
A realistic school cyber security plan should cover:
- Multi-Factor Authentication for staff and admin accounts
- Microsoft 365 security reviews
- identity monitoring for suspicious logins and mailbox changes
- managed endpoint detection and response
- secure backup and tested recovery
- email security to reduce phishing and malicious links
- patching and asset visibility
- remote access reviews
- security awareness training
- clear incident response planning
For MATs, consistency also matters.
A trust with different tools, settings and processes in every school can be difficult to govern. Standardising controls across sites makes it easier to manage risk, evidence progress and support trustees with clearer reporting.
How this links to DfE and RPA expectations
The Department for Education’s cyber security standards and RPA expectations have already pushed schools to think more seriously about cyber resilience.
That includes areas such as backups, patching, anti-malware, MFA, incident response, training and governance.
The Huntress report adds useful context because it shows why those controls matter in real life.
MFA matters because identity is now a key attack path.
Tested backups matter because ransomware and data loss can disrupt learning.
Patching matters because avoidable weaknesses give attackers easier options.
Monitoring matters because attacks often happen outside the normal school day.
Training matters because social engineering still works.
Cyber security is now part of safeguarding
This is a point I keep coming back to.
Cyber security in schools is not just about computers.
If a cyber incident blocks access to safeguarding records, exposes pupil data, compromises staff accounts or disrupts communication, it can quickly become a safeguarding issue.
That does not mean every headteacher needs to become a cyber expert.
It does mean school leaders, governors and trustees need to understand the risk well enough to ask good questions.
Useful questions for school leaders and trustees
Here are some questions worth asking:
- Do we know which remote access tools are used across our school or trust?
- Are Microsoft 365 accounts monitored for suspicious behaviour?
- Could we spot a compromised mailbox or malicious inbox rule?
- Are backups protected from deletion or tampering?
- When did we last test recovery?
- Who reviews cyber alerts during evenings, weekends and school holidays?
- Are staff confident reporting suspicious emails or prompts?
- Do governors and trustees receive clear cyber risk updates?
None of these questions are about buying shiny technology for the sake of it.
They are about understanding whether the school can prevent, detect, respond and recover.
Final thought
The message from the Huntress 2026 Education Cyber Threat Report is not that schools should be frightened.
It is that schools should be realistic.
The attacks are changing. They are quieter, more identity-focused and more likely to abuse trusted tools and trusted people.
That means schools and trusts need visibility, evidence and support, not just antivirus and hope.
Good cyber security should protect learning time, pupil data, staff confidence and the systems schools depend on every day.
And it should do that in a way that works for real schools, with real budgets, real pressures and very little spare time.
Need help reviewing your school’s cyber resilience?
Black Swan Cyber Security helps schools, academies and multi-academy trusts strengthen protection, support DfE and RPA expectations, improve Microsoft 365 security, protect backups and monitor for threats outside school hours.
View our cyber security support for schools and MATs or book a school cyber review.
