Attacks on schools are up, phishing is behind most of what staff see, and AI is making the emails much harder to spot.
The education findings from the government's latest Cyber Security Breaches Survey, published in April 2026, make uncomfortable reading. 73% of secondary schools said they'd identified a cyber breach or attack in the previous 12 months, up from 60% the year before. Secondary schools were the only part of the education sector where the rise was statistically significant.
It's worth being clear about what that number counts. It includes attempted attacks that were spotted and stopped, not just ones that got through. One in five secondary schools that identified an incident said it had a real impact on their systems. That's still a lot of schools, but it's a different picture from "three-quarters were breached".
Of the secondary schools that identified an incident, 96% had seen phishing. That's not surprising. Phishing emails are cheap to send and go out in huge volumes, so almost every organisation gets them - 88% of businesses that identified an attack reported phishing too.
What really matters is how many get through, because phishing is usually the first step towards something worse. A stolen password or a click on the wrong link can lead to account takeover, payment fraud or, sometimes, ransomware. Ransomware was reported by 6% of the secondary schools that identified an incident.
Schools are a good target for that first step. Staff are busy, inboxes are full, and lots of people deal with parents, suppliers and outside agencies every day. An attacker doesn't need to get past your firewall if they can get someone to click a link, open an attachment or change some bank details.
Stopping one bad click from turning into a serious incident is where most of the effort needs to go.
IT leads interviewed for the survey kept coming back to the same worry. Generative AI lets attackers write convincing emails and impersonate real people at scale. The old giveaways, like clumsy grammar or odd phrasing, can't be relied on any more.
One secondary-phase trust described what happened when it ran its own phishing tests. Click rates had been falling until it sent a convincing fake email about payroll changes. The rate jumped from 5% to 17% across the trust. This example shows why phishing training needs to prepare staff for convincing messages about familiar, important topics.
Another school raised a concern about over-reliance on AI: staff still need to apply their own judgment and check suspicious messages.
Nearly every school in the survey said cyber security was a priority for its leaders. The detail is patchier. In secondary schools:
• 73% had a governor or senior leader with responsibility for cyber security
• 64% updated governors or senior leaders on it at least quarterly
• 47% had reviewed the cyber risks posed by their immediate suppliers
• 53% had already adopted AI tools
So roughly a quarter of secondary schools have nobody at board or senior level who owns cyber risk, and fewer than half had reviewed the cyber risks posed by their immediate suppliers. Meanwhile AI tools are rapidly being adopted.
Our AI Governance in MATs Benchmark found the same uneven picture on the AI side, with trusts at very different stages on governance, risk, visibility and assurance:
13% fully confident on ICO Children's Code alignment
Cyber and AI governance raise the same core questions: who is accountable, how is risk assessed, what visibility do leaders have, and what reaches the board?
You won't stop every phishing email, but you can make it much harder for one to do real damage. In practice that means:
• a named person at board or senior level who owns cyber and AI risk
• regular, realistic phishing tests, with follow-up training for the people who get caught out
• an incident response plan that's actually been rehearsed
• checks on what your suppliers do with your data and how they protect it
• regular reporting to the board, not just when something goes wrong
The rise from 60% to 73% reinforces the need for both technical protection and clear governance. As phishing becomes more convincing, trusts need clear accountability, tested response plans and regular reporting to the board.
See where your trust stands. Take the GDPRiS AI Governance & Readiness Assessment to compare your approach with the benchmark and identify priorities for improvement.