There’s a line in the latest reporting from Infosecurity Magazine that sticks.
Not the 63% rise in attacks. Not even the 73% increase in breaches. It’s the quieter point underneath it.
Education can’t just lock things down.
That tension has always been there. Schools, colleges and universities are built on openness – shared access, collaboration, external partnerships, remote learning, research. It’s part of the job. But it’s also what attackers rely on.
What’s actually changing
The figures (reported by Phil Muncaster, based on Quorum Cyber’s outlook) show a shift that many IT leads have already felt over the past 12–18 months.
- Attacks up 63% globally
- Breaches up 73%
- Hacktivism up 75%
- Ransomware still climbing
This isn’t just one type of threat getting worse. It’s multiple pressures landing at once:
- Nation-state interest in research (AI, quantum, materials)
- Hacktivist disruption (DDoS, defacement, leaks)
- Criminal activity (ransomware, infostealers, account takeovers)
Different motives. Same outcome – disruption to teaching, safeguarding concerns, and operational chaos.
What we’re seeing on the ground
Across schools and trusts, the patterns are less dramatic, but more consistent.
Not headline-grabbing breaches. More often, it’s the near misses.
- A login from somewhere it shouldn’t be
- A mailbox rule quietly forwarding messages
- Credentials exposed in a third-party breach
- Backup in place… but never tested
- Staff under pressure making quick decisions
None of these look like a “cyber attack” in isolation. But string a few together and it becomes one.
The uncomfortable bit
Security advice in education hasn’t really changed:
- Patch what matters
- Use strong authentication
- Train staff
- Back things up
- Test your response
It’s not new. What’s changed is the speed and frequency of attacks hitting gaps that already existed. That’s why the report leans into resilience rather than prevention alone. Because in education, you can’t remove access – you have to manage it.
Resilience over restriction
One quote from Queen Mary University of London sums it up well:
It’s critical to know where you’re exposed, spot threats early and respond quickly before incidents escalate.
That’s the shift. Not “stop everything getting in” – that’s unrealistic.
More like:
- Know what normal looks like
- Notice when it changes
- Have a plan when it does
- Be able to recover properly
The bit most places skip
Backups get mentioned in every report. But recovery rarely gets tested.
There’s a big difference between: “We have backups” and “We’ve restored from them under pressure and know it works”
Same goes for incident response. A plan on paper isn’t the same as a team that’s walked through it.
Where this leaves schools and trusts
This isn’t about fear. It’s about recognising the shape of the problem.
Education isn’t failing at cyber security. It’s dealing with a harder version of it than most sectors.
Open environments.
Limited budgets.
High impact when things go wrong.
The goal isn’t perfect security. It’s fewer surprises, faster response, and recovery that actually works.
Credit: Reporting by Phil Muncaster, Infosecurity Magazine
