Cyber criminals don’t work school hours. Your IT team shouldn’t have to work their hours either.
Schools have spent a lot of time talking about cyber security controls. MFA. Backups. Antivirus. Patching. Passwords. Staff training. But there is another question I think school leaders need to start asking: What happens when something goes wrong at 2am?
Or at 7pm on Friday or halfway through the Christmas holidays.
Having good security technology and having somebody able to respond to what that technology detects are two different things.
Education is already a significant target
The latest Huntress Education Cyber Threat Report says education accounted for 16% of all incidents it observed during 2025.
That’s not particularly surprising to anyone who has spent much time working in schools.
Education has many of the characteristics that make life difficult for an IT team and attractive to an attacker: limited budgets, small teams, large numbers of users and devices, remote administration and significant amounts of sensitive information.
The report describes these as structural issues rather than temporary ones. You can’t simply remove those characteristics. A school needs teachers, pupils, cloud services, laptops, email and remote support.
So the challenge becomes detecting when something legitimate is being used illegitimately.
The attacker might already be using your IT tools
One statistic in the Huntress research particularly caught my attention. Malicious RMM tools (Remote Monitoring and Management) use increased by 277% year-on-year in 2025.
They’re the tools IT departments and support companies legitimately use to look after computers remotely.
The education report says RMM abuse was slightly higher in education than in other sectors, potentially because schools rely heavily on remote administration.
That creates an interesting problem.
Traditional cyber security thinking often asks: “Is this software malicious?”
Increasingly, the better question is: “Is this legitimate software being used maliciously?”
PowerShell is legitimate.
Remote management software is legitimate.
VPNs are legitimate.
Administrator accounts are legitimate.
But in the wrong hands, all of them can become part of an attack and that can be considerably harder to spot than an obviously malicious executable appearing on a computer.
Identity has become part of the battleground too
The same report highlights another important shift – attackers increasingly don’t need to “hack” their way into an organisation if they can simply authenticate as somebody who already belongs there.
Huntress observed attacks involving MFA fatigue, token theft, OAuth abuse, adversary-in-the-middle techniques and mailbox manipulation during 2025.
That’s important for schools because so much now revolves around Microsoft 365 or other cloud identities.
Email.
SharePoint.
Teams.
OneDrive.
Administrative systems.
An attacker doesn’t necessarily need control of a laptop if they’ve managed to take control of the identity sitting behind it. Again, detecting that requires context.
A login at 2pm from Chesterfield might be perfectly normal.
The same account suddenly behaving differently at 2am may deserve a closer look.
Twenty hours isn’t very long
This is where the second piece of Huntress research becomes particularly relevant.
Its off-hours readiness report says average time-to-ransom increased from 17 hours to 20 hours during 2025. Twenty hours might sound reasonably generous. In a school environment, it really isn’t.
Imagine an attacker establishes access at 4pm on Friday.
Twenty hours later it’s midday Saturday.
Even during the working week, access gained late in the afternoon could potentially develop significantly before somebody starts work the following morning and ransomware isn’t necessarily the first thing an attacker does.
Huntress reports that around 17% of ransomware incidents had identity-related precursor activity at least seven days before deployment, increasing to nearly 21% within a 14-day window.
That is actually encouraging in one respect as there may be opportunities to stop an attack before you reach the dramatic bit, but only if somebody notices those earlier signals.
The answer isn’t making your Network Manager work all night
Whenever we talk about 24/7 monitoring, I don’t think the answer is expecting school IT staff to become permanently on-call.
I’ve worked alongside school IT teams for over two decades. Many are already balancing support tickets, safeguarding requirements, devices, MIS systems, printers, Wi-Fi, classroom technology, compliance, projects and everything else somebody decides is “an IT thing”.
Adding: “Could you keep an eye on the cyber security alerts tonight?” isn’t resilience – It’s burnout.
The Huntress off-hours report makes a much more sensible point: organisations should know who takes the first look, who backs them up, who has authority to contain an incident, who needs informing and what happens next.
That matters as much as buying another security product.
Could you answer these questions today?
Imagine a high-confidence security alert arrives at 2am on Sunday.
Do you know who sees it?
Can they investigate it?
Can they isolate the computer?
Can they disable the affected account or revoke its sessions?
Do they know who needs contacting?
Can they access the information they need without waiting for somebody else to wake up?
If the incident becomes serious, does everybody know who has authority to make decisions?
Those are operational questions rather than technical ones, but during an actual cyber incident, they can make an enormous difference.
The Huntress report groups this into five areas: clear ownership, containment authority, connected visibility, escalation paths and realistic coverage.
I think “realistic coverage” is particularly important for schools.
Don’t design an incident response plan around the IT team you wish you had. Design it around the people you actually have.
This is where managed detection and response makes sense
This is also why Black Swan Cyber Security Solutions partners with Huntress.
I don’t think smaller organisations should have to build their own Security Operations Centre to get proper monitoring and for most schools, that would be completely unrealistic.
Huntress provides 24/7 monitoring across endpoints, identities and logs, backed by its Security Operations Centre. Its off-hours report states an average mean time to respond of eight minutes, from receiving an alert to sending an incident report.
For me, though, the important part isn’t the acronym MDR, EDR or SOC, It’s the outcome.
Your Network Manager can finish work.
They can have dinner.
They can sleep.
They can go away for the weekend and there is still somebody looking for the activity that shouldn’t be there.
Cyber security shouldn’t depend on somebody checking their phone
Schools will never have unlimited cyber security budgets, nor should they need them.
The objective should be proportionate security that reflects the actual risk and resources available.
That means doing the fundamentals well: patching, MFA, backups, identity security, email protection, staff awareness and sensible administrative controls.
But it should also mean accepting a simple reality. Attackers don’t stop when the school closes. Your response arrangements shouldn’t stop either.
That doesn’t mean your staff have to work around the clock. In fact, I’d argue the opposite. Good cyber security should give the people responsible for IT the confidence to switch off.
Your staff should be able to switch off. Your cyber security shouldn’t.
