Ofqual’s third annual cyber security survey brings some encouraging news for schools: reported cyber incidents are falling and recovery is improving.
But another finding raises an important governance question: do staff know who is accountable for cyber risk?
The proportion of schools experiencing a cyber incident fell to 27% in 2025–26, compared with 29% the previous year and 34% in 2023–24. Recovery also improved, with 66% able to recover immediately, up from 55% the year before.
For Ofqual, cyber resilience matters because incidents can create uncertainty for students if coursework or marks are lost. As Amanda Swann, Executive Director of Delivery, put it, the effects on staff confidence can continue even after systems are restored.
The 27% figure may look surprising alongside the government’s Cyber Security Breaches Survey 2025/2026, which found that 73% of secondary schools had identified a breach or attack in the previous 12 months.
But these figures should not be treated as directly comparable.
The government survey measures breaches or attacks institutions identified, with phishing overwhelmingly the most common threat. Among secondary schools that identified a breach or attack, 96% reported phishing. The government also cautions that its survey only captures attacks organisations themselves identified.
Ofqual’s survey, meanwhile, was conducted by Teacher Tapp in July 2026. Its school-level findings represented responses from up to 2,162 schools, while teacher-level percentages were based on 3,775 secondary teachers in England.
So the lower reported incident rate is encouraging, but it does not, on its own, establish that schools are facing fewer attempted attacks.
This is where the Ofqual findings become particularly interesting. When teachers were asked who was primarily responsible for cyber security at their school:
46% said the IT team
9% said senior leadership
Ofqual described the results as showing a lack of consensus over responsibility. Amanda Swann was more direct: “Cyber security isn’t just an IT problem; it’s a leadership responsibility.”
The answers are not necessarily contradictory. IT teams manage technical safeguards, while every member of staff has a role in recognising and reporting potential threats. But shared responsibility still needs clear accountability.
That becomes particularly interesting alongside the government survey. It found that 73% of secondary schools had a board member, trustee, governor or senior manager who took responsibility for cyber security.
The two surveys cannot tell us whether teachers in those same schools knew who that person was. But together they prompt a useful question for school and trust leaders: Is cyber accountability simply assigned, or is it understood across the organisation?
Having policies and controls is important. Ofqual found that 55% of secondary schools surveyed had already taken action to protect against cyber attacks, including implementing cyber security policies, carrying out risk assessments and putting backup and recovery procedures in place.
The next step is making sure people know how those arrangements translate into decisions when something actually goes wrong.
If a critical system becomes unavailable:
Who coordinates the response?
Who makes decisions about priorities?
Who communicates with staff?
Who keeps governors or trustees informed?
Who provides assurance that recovery is working?
The point isn't that leadership should take over the technical response. It is that technical responsibility, organisational responsibility and governance oversight need to connect.
Cyber security and AI governance involve different risks, but both need clear ownership and board oversight. Our AI Governance in MATs 2026 Benchmark found:
50% reported a named AI owner
47% reported an approved AI register
25% reported regular board reporting
The practical question is the same: do leaders know who is accountable, what needs attention and how concerns reach the board?
Your IT team or MSP may operate technical controls day to day, and staff have their own responsibilities for following procedures and reporting concerns. Leadership oversight should connect those activities by:
agreeing how cyber risks are assessed, managed and escalated
ensuring those responsible have appropriate resources and support
understanding the main risks and tracking action against them
providing useful, regular reporting to governors or trustees
testing incident response and recovery plans rather than simply documenting them
And staff should know who leads when something goes wrong, how to reach them and what they themselves are expected to do.
Because naming an owner only gets you so far. Accountability works when people understand it.
Fewer reported incidents and faster recovery are encouraging. The next step is to make sure everyone understands their role: IT teams manage technical safeguards, staff follow procedures and report concerns, and leaders remain accountable for managing the risk.
If you’re reviewing these responsibilities for AI, complete the GDPRiS AI Governance & Readiness Assessment to compare your approach with the benchmark and identify priorities for stronger accountability and assurance.