October is Cyber Security Awareness Month, and this year's theme is "Don't Make It Easy for Them".

We don't think cyber security awareness is something to cover just once a year, but this month gives us a focus. Every day in October we'll share a short topic and one practical action you can take straight away.

What is Cyber Security Awareness Month?

It's a global campaign held every October since 2004 to promote safer online behaviour. It is co-led by the National Cybersecurity Alliance and CISA. This year the Alliance's theme is built on the idea that staying safe online comes from small habits repeated every day, not from one perfect decision. RansomLeak

That suits how most attacks work. Most cyber attacks involve some human interaction, such as clicking a phishing link, sharing credentials or approving a fraudulent request. Attackers take the easiest route available. Every good habit makes that route harder. MetaPrivacy

Why does it matter for education?

Schools and colleges hold large amounts of personal data, much of it about children, and they are a regular target. The government's Cyber Security Breaches Survey 2025/26 found that 73% of secondary schools had identified a breach or attack in the previous 12 months, up from 60% the year before. The figure was 88% for further education colleges and 98% for higher education institutions. Phishing was by far the most common type of attack, and the report notes that attackers are increasingly using AI to make phishing emails more convincing and harder to spot. Data Protection

Cyber security isn't just an IT issue. It protects pupils' and staff members' personal data, keeps lessons and services running, and maintains the trust of families and communities. Because one weak link can expose a whole system, it's everyone's responsibility.

Cyber security is a leadership issue

Cyber security can't be left to the IT team. Leaders, governors and trustees set the priorities, decide where resources go and are accountable for how a school protects the personal data it holds. Awareness at this level is high: almost every education institution in the 2025/26 survey said cyber security was a priority for its governors or senior management. The challenge is turning that priority into action. GOV.UK

That is where the DfE Digital and Technology Standards come in. The DfE's ambition is for all schools and colleges to meet six core standards by 2030, including cyber security and digital leadership and governance. The two work together. The cyber security standard sets out the protections a school should have in place, such as multi-factor authentication, secure configuration and a plan for responding to an incident. The digital leadership and governance standard is about ownership: a named senior leader and a named governor or trustee should hold responsibility. That makes it clear who is accountable for the risk, and who is asking the questions.

Governors and trustees can start this month by asking:

• Who is responsible for cyber security, and how often do they report to the board?
• Where are we against the DfE cyber security standard, and what is our plan for the gaps?
• Is cyber risk on our risk register?
• Do we have a tested incident plan, and does everyone, including governors, know how to report an incident?

Our DfE Digital Standards Tracker can help you record your progress and evidence it to your board; start with the DfE Leadership & Governance Standard.  Get a FREE overview of the Standards here: DfE Digital Standards Overview.

What to expect this month

Each day we'll cover a different topic, from passwords and multi-factor authentication to spotting scams, with a daily tip you can act on in a few minutes. Follow along, share it with colleagues, and let's make this month a commitment to making life harder for cyber criminals.

💡 Today's Cyber Tip: Switch on multi-factor authentication for your email

Start with the account that unlocks all the others. Your email is how most services reset a password, so if someone gets into it, they can get into a lot more.

Take five minutes today to turn on multi-factor authentication (MFA) for your main email account. Then a stolen password on its own won't be enough to get in.

DPE Knowledge Bank Guidance and Support

Our DfE Digital Standards Tracker helps schools and colleges track their cyber resilience and progress: A Risk Led Order for the DfE Digital Standards

Explore our Cyber Security Best Practice Area for micro learning, guidance and policies.

Why not meet our "specialist" trainer, Harry the Hacker?