The National Cyber Security Centre (NCSC) published its Annual Review 2026 on 3 November. It looks back on the NCSC's tenth year, from September 2025 to August 2026, and ahead at the threats coming next.
The review doesn't single out schools, but its lessons apply directly to them. Here's what school and trust leaders, IT teams and governors need to know.
Earlier this week, in Cyber security: the risk governors aren't naming, we looked at why cyber is missing from governors' list of challenges. This article looks at the threat itself.
The year in numbers
|
Reports of cyber attacks received by the NCSC |
1,831 |
|
Incidents that needed NCSC support |
337 |
|
Incidents classed as nationally significant |
80 |
|
Organisations warned of a suspected compromise through the NCSC's free Early Warning service |
8,500 |
The NCSC is clear that these numbers don't tell the whole story: incident levels rise and fall from year to year, and early warnings will have stopped some incidents before they grew. For schools, the more useful picture is how attackers got in.
7 lessons, and what they mean for schools
The NCSC drew seven lessons from the 337 incidents it supported. Each one maps onto something the DfE cyber security core standard already asks schools to do.
|
NCSC lesson |
What it means for your school or trust |
|---|---|
|
1. Attackers exploit the basics. Known vulnerabilities and poorly secured internet-facing systems remain the main way in. |
Make sure critical security updates are applied within 14 days, as the DfE standard requires, and that unsupported software is replaced. |
|
2. People remain the target. Social engineering and stolen credentials are common. |
Train staff, and at least one governor or trustee, every year. Turn on multi-factor authentication for staff and admin accounts. |
|
3. State and criminal attackers share weaknesses. They use the same routes in. |
You don't need to be a high-profile target to be attacked. Basic cyber hygiene protects against both. |
|
4. Ransomware remains highly disruptive. It brings extortion, data theft and long recovery times. |
Keep immutable, offsite backups and test restoring them every term. A ransomware attack is almost always a personal data breach too. |
|
5. Preparation determines outcomes. Logging, monitoring, incident response planning and supplier resilience decide the impact. |
Have a cyber response plan in your business continuity plan, test it, and check how your IT provider and other suppliers protect your data. |
|
6. Early action reduces impact. Fast detection stops incidents growing. |
Make sure staff know how to report a suspicious email or incident quickly, and that they feel safe doing so. |
|
7. Attackers don't need to be sophisticated to get in. The sophistication comes after they're inside. |
The simple controls matter most: strong passwords, MFA, patching and staff awareness. |
AI and the widening divide
The review's assessment of AI has three messages for schools:
- Attacks will get faster, not different. AI is speeding up and scaling existing attack methods rather than inventing new ones, so established controls still work.
- The window to patch is shrinking. AI is helping attackers find weaknesses faster, so systems need updating sooner after a fix is released.
- A divide is opening up. Organisations with limited resources, older technology and weak AI governance will struggle to keep pace, and will become more attractive targets. Many schools and trusts under budget pressure are in that position.
The NCSC also warns about "shadow AI": staff using unapproved AI tools, sometimes moving data onto personal devices to do so. We look at this, and the AI policy gap in schools, in AI in schools: the governance gap behind the tools.
Free NCSC help for schools
The NCSC offers several free services and resources that schools can use now:
|
Service |
What it does |
|---|---|
|
Alerts you to signs your systems may have been compromised. It sent 8,500 alerts this year. |
|
|
Free annual training. Schools with RPA cover must evidence that relevant users have completed it. |
|
|
Lets you practise your response to a cyber incident. |
|
|
Helps check your email is set up to stop others impersonating you. |
|
|
Helps boards understand their role in cyber risk. |
|
|
Questions to help boards understand the school's IT and cyber risk. |
The review also highlights supply chain risk. The government's Cyber Resilience Pledge commits to rolling out Cyber Essentials across supply chains, so it is worth asking your IT provider whether they hold Cyber Essentials or Cyber Essentials Plus.
What to do next
The NCSC's overall message is that getting the basics right is still the most effective way to reduce both the chance and the impact of an attack. In schools, those basics need someone to own them, and a board that asks about them.
Our article Cyber security: the risk governors aren't naming looks at why that ownership is often missing, and how a Data Protection Governance Lead can help close the gap. It ends with questions to take to your next board meeting.
DPE resources that support the NCSC's lessons:
- Cyber risk register template, aligned to the DfE cyber security standard
- What to do in the event of a cyber attack, covering who to report to and when
- DfE Digital Standards Roles and Responsibilities, showing who does what
- Cyber Security Awareness Month 2026 series, with daily tips to share with staff and governors
To hear about new guidance as it's published, sign up to Keep in the Know, DPE's newsletter.
Sources
- NCSC Annual Review 2026 (November 2026)
- NCSC Annual Review 2026: incident management
- NCSC Annual Review 2026: 7 things we learned
- NCSC Annual Review 2026: the impact of AI on cyber threat
- DfE cyber security core standard
Disclaimer: These resources are for general educational purposes only and are provided "as is." While we strive for accuracy, Data Protection Education makes no warranties regarding completeness or suitability. Use of these materials does not constitute professional legal or data protection advice; please seek independent counsel for your specific circumstances. To the extent permitted by law, we are not liable for any losses arising from the use of these resources. All intellectual property remains with Data Protection Education; personal or internal organisational use is permitted subject to our terms and conditions.