The National Cyber Security Centre (NCSC) published its Annual Review 2026 on 3 November. It looks back on the NCSC's tenth year, from September 2025 to August 2026, and ahead at the threats coming next.
InfoSec / Cyber
- Tammy Buchanan
- Information/Cyber Security
Incident Management and Escalation When a Cyber Attack Occurs | October 30
The worst time to work out who’s supposed to do what is during the incident itself. A cyber incident response plan only earns its name if it’s been read, agreed, and actually rehearsed before the day it’s needed.
Hackers are always finding new ways to break into accounts, and password attacks remain one of the most successful routes into school and trust systems. Password security isn't just an IT job: everyone with a login has a part to play.
This article explains what a cyber incident is and what you should do if your school or trust experiences one. A cyber incident isn't necessarily a full-blown cyber attack, but it should still go through your reporting and risk management processes.
- Tammy Buchanan
- Information/Cyber Security
Anti-Malware & Endpoint Defence – Real-Time Protection | October 26
Antivirus software used to be something you installed once and forgot about. That’s no longer good enough, not because the software changed, but because what it’s defending against did.
- Tammy Buchanan
- Information/Cyber Security
Cyber Career Week: Who's Actually Responsible for Cyber? | October 19
This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.
- Tammy Buchanan
- Information/Cyber Security
Filtering & Monitoring: Safeguarding the Digital Boundary | October 18
Filtering and monitoring sit either side of the same boundary. Filtering is preventative, it stops users reaching illegal, inappropriate, or harmful content before they ever see it. Monitoring is reactive, it watches what's actually happening on your network and devices, so concerning activity doesn't go unnoticed. Together, they're one of the few controls that serve both cyber security and child safeguarding at once.
- Tammy Buchanan
- Information/Cyber Security
Perimeter & Gateway Security: Firewalls & Network Isolation | October 17
Day 16 looked at access control from the outside in: securing the connection when staff work beyond school walls. Today we go back to the perimeter itself: the firewall every one of those connections has to pass through, and the network behind it. A firewall that's switched on but never reviewed, or a network where one device can talk to everything else, undoes a lot of the good work covered so far this month. Perimeter and gateway security is less glamorous than ransomware or phishing, but it's the layer that decides whether an intrusion stays contained or spreads.
Every attacker chasing a school network has the same goal once they're in: find an account with more power than it needs. A compromised standard user account is a nuisance. A compromised admin account is a takeover, it can touch every system, every dataset, and every piece of security infrastructure built to stop exactly this. It can probably reset passwords.
Over the past two weeks, we've covered how attackers get in: phishing, deepfakes, ransomware, and what to do when they do. Access control is about the layer that decides whether any of that actually works: even a perfectly crafted phishing email or a stolen password is useless to an attacker if the account behind it is properly protected. Today we look at the single most effective access control measure available, where it still falls short, and what's changing.
- Tammy Buchanan
- Information/Cyber Security
Preventing Ransomware | October 12
The NCSC advises: "there's no way to completely protect your organisation against malware infection." That's not a reason to give up, it's the reason defence-in-depth exists. Instead of relying on one control to stop everything, you build multiple layers, so that if one fails, the next one catches it, and if an attacker does get in, the damage is contained and recovery is fast.
- Tammy Buchanan
- Information/Cyber Security
The Reality of Ransomware | October 11
Ransomware headlines tend to focus on big retailers, hospitals, and government agencies. But schools and colleges are an escalating, and in some ways more vulnerable, target, and a recent case shows exactly how indiscriminate the threat is.
- Cyber Posture: From reactive panic to proactive preparedness | October 10
- Normalising Immediate Incident Reporting | October 9
- Phishing: AI-Crafted Bait | October 8
- AI Deep Fakes: Synthetic Video & Visual Verification | October 7
- AI Deep Fakes: Spotting Audio & Voice Cloning Scams | October 6
- Cyber Responsibilities - We're all in this together! | October 5
- Data Protection & DPIAs – Safeguarding Pupil & Staff Data | October 3
- Behavioural Change – From Passive Training to Active Vigilance | October 2
- Welcome to Cyber Security Month 2026 – Don't Make It Easy For Them! | October 1
- The DfE Cyber Attack: What Schools Should Look Out For Next Term
- What School Leaders Need to Know About the DfE's New Cyber Security Hub
- A guide to multi-factor authentication
- World Password Day
- The Cyber Security Breaches Survey 2025/2026 - Key Advice for Schools
- Holiday Cheer or Cyber Fear? : Essential Pre-holiday Checks
- What is the Stryker cyber attack and why should schools be wary?
- Cyber Alert: Surrey and Sussex Schools Targeted by Phishing and Ransomware Attacks
- Is your IT Support Provider Compliant?
- The Government Cyber Action Plan
- Shareable Snippet: Be Cyber Ready
- What does the technology in schools survey tell us?
- Four London councils hit by cyber attacks - Hackney, Westminster, Kensington & Chelsea, and Hammersmith & Fulham
- IT Support Standards for Schools and Colleges Guidance (DfE Digital Standards)
- Time's Ticking: Windows 10 support ends in October 2025!
- Nursery Cyber attack
- The NCSC Cyber Assessment Framework
- The Classroom's Dark Side: Cyber crime from the Classroom
- The Latest Cyber Threat: The "Murky Panda"
- Social engineering + impersonation = Fraud ≡ cyber deception
- School cyber attack: Framlingham College, Suffolk
- Getting caught in the Scattered Spider web
- A Wake-Up Call for Cyber Vigilance - Danger in the Threat Landscape for Everyone
- Apple removes its highest level data security tool from UK customers
- Effectively communicating during a cyber incident
- Safeguarding Identity in Microsoft 365: Protecting the UK Education Sector Against Cyber Threats
- How does the recent global IT outage affect me?
- King's speech introduces new bills in relation to cyber security, smart data and digital information
- Free short cyber training for staff
- Children's mental health data leaked after a cyber attack
- Cyber Incident Review: The Benefits
- Cyber attack on a University
- Kent Councils Data Breach
- Phishing attacks targeting schools - alert from City of London Police
- Update on Advisory for Rhysida Ransomware
- The Crime in a Cyber Attack and a Data Breach
- Learning from Data Breaches
- Windows 11 security ineffective against attacks on old devices
- International Counter Ransomware Initiative 2023 Joint Statement
- Top Ten Cyber Security Misconfigurations
- ICO Reprimand: company suffered a ransomware attack
- The UK Online Safety Bill becomes an Act (Law)
- The importance of software updates (PaperCut vulnerability and Rhysida ransomware)
- Ransomware, extortion and the cyber crime ecosystem
- Cyber Resource: The Cyber Resilience Centre Group
- Email and Security: ICO recent guidance
- What to do in the event of a Cyber Attack
- Cyber Crime: AI Generated Phishing Attacks
- Cyber Attack: Exam Boards
- VICE SOCIETY - Ransomware attacks on schools
- Be Cyber Aware: USB Sticks
- Cyber Insurance in the Public Sector
- Types of Cyber Attacks: DDos Attack (Microsoft DDoS Attack in June)
- Cyber Attack: Leytonstone School
- Be Cyber Aware: Firewalls
- Be Cyber Aware: Cyber attacks and transparency. A no blame culture
- Cyber Attack: Dorchester School
- Be Cyber Aware: Why regular software updates are important
- Cyber Attack: Wiltshire School
- Keeping your IT systems safe and secure
- Why we recommend using PIN codes on printers
- Types of Cyber Attacks: DDoS Attacks
- Types of Cyber Attacks: Phishing
- Types of Cyber Attacks: The Insider Threat
- Why your data is profitable to cyber criminals
- Types of malware and how they are linked to data protection
- How a school fought back after a cyberattack
- Types of Cyber Attacks - Credential Stuffing
- January Cyber update - How Can Schools Help Prevent Cyber Attacks?
- The Education sector now at highest risk of cyber attacks
- Cyber Attacks
- Emails – good practice and minimising the risk of a data breach
©2026 Data Protection Education Ltd.