Cyber risk in education: how AI is increasing the threat
Cyber risk in education is high
The UK education sector is heavily exposed. The government’s 2025/26 Cyber Security Breaches Survey found that 49% of primary schools, 73% of secondary schools, 88% of further education colleges and 98% of higher education institutions had identified a cyber breach or attack in the previous 12 months.
Why education is a prime target for cyber attacks
Education institutions hold a rich mix of data: pupil and student records, safeguarding information, staff details, payroll data, research data, parent and guardian contacts, medical information and supplier records. This makes them an attractive target for fraud and cyber crime. They also rely on a wide range of systems, from virtual learning environments and student information systems to finance platforms, apps, cloud storage and third-party learning tools. Managing security consistently across these environments can be challenging, increasing cyber risk.
Globally, education and research was the most attacked sector in 2024, according to a report released last year from Statista, with an average of 3,574 cyber attacks per organisation each week, ahead of government and healthcare. In the UK, the Department for Education’s Cyber Security Hub noted that education was one of the top three most attacked industries in 2024 to 2025, with ransomware, phishing and supply chain attacks among the most common threats. It also cited that more than 80 education sector ransomware attacks were reported to the ICO in 2024, with phishing involved in 92% of incidents reported by primary schools and 89% by secondary schools.
The issue now is that AI is changing the pace and scale of that risk.
How AI is increasing the cyber security threat in education
For many institutions, the AI debate has focused on academic integrity, assessment and responsible student use, but they must now also seriously consider how AI enables cyber attackers. Poorly written phishing emails can now be replaced with tailored messages that adopt the tone, terminology and timing of a real school, Multi-Academy Trust (MAT), college or university. Deepfake audio can make impersonation more credible. AI tools can help attackers secretly survey an organisation’s systems, identify weaknesses and help less sophisticated criminals find ways to manipulate employees and trick them into giving sensitive information or access.
The education sector is aware of the threat, according to a survey published in the World Economic Forum’s Global Cybersecurity Outlook 2026. It found that 94% of respondents expected AI to be the most significant driver of change in cyber security in the year ahead, while 87% identified AI-related vulnerabilities as an increasing cyber risk over the previous year.
In education, the attacks may come on multiple fronts. A university research team may be exploited to gain access to intellectual property. A school finance team may be exposed to invoice fraud. An admissions team may be targeted using fake applicant or agent communications. A teacher may be tricked into entering and giving away their credentials through a convincing but fake learning platform notification. A student may upload sensitive information into an unapproved tool without understanding the implications.
Emerging cyber risks
Looking ahead, recent developments show why AI-enabled cyber risk is no longer theoretical. Models such as Anthropic’s Mythos and other advanced cyber-capable systems point to a future where vulnerability discovery, exploitation and testing may become increasingly automated. In August 2026, OpenAI disclosed that some of its advanced models had broken out of a sandboxed testing environment and gained unauthorised access to parts of Hugging Face's systems, one of the world’s largest open-source AI platforms. That does not mean every education institution will face a frontier AI attack tomorrow, but it does mean security teams need to plan for threats that can move faster, scale more easily and adapt in ways that traditional controls may not always anticipate.
Preparing for future quantum computing threats
Quantum computing, an emerging technology that could one day break some of the encryption methods used to protect sensitive data, is another longer-term issue. It is not an immediate day-to-day risk for most schools or colleges, but it should be on the radar for universities and larger education groups holding long-life sensitive data. The National Cyber Security Centre (NCSC) has warned that the computing speed and problem-solving capabilities of a quantum computer could, in future, undermine the widely used public-key cryptography that protects data. For institutions holding research, health, safeguarding or student records, it will be increasingly important to strengthen data retention and cryptographic planning.
How AI can strengthen cyber security defences
There is a positive side. AI can also strengthen cyber defence. It can help detect unusual login behaviour, triage alerts, identify phishing patterns, support incident response and improve monitoring across complex estates. For institutions with stretched IT teams, AI-enabled tools may help close some capability gaps. But they are not a substitute for basic controls, governance or human judgement.
Five cyber security priorities for schools, colleges and universities
Identify and protect critical data
Safeguarding, student, staff, payroll, research and finance data should be mapped, classified and protected according to impact, not convenience. This should also include understanding where that data sits across interconnected systems, apps and third-party platforms.
Strengthen phishing and impersonation controls
Training still matters, but it needs to reflect AI-enabled threats, including deepfake audio, realistic supplier emails and targeted approaches to finance, HR and admissions teams.
Improve third-party cyber assurance
Learning platforms, apps, managed service providers and cloud tools should be reviewed through a cyber and data protection lens, with clear expectations on incident notification, access controls, data retention and resilience arrangements.
Test cyber resilience and incident response plans
Multi-factor authentication, patching, secure backups and privileged access management remain critical. Institutions also need a clear cyber incident playbook so that, if systems go down or data is compromised, leaders know who is making decisions, who is communicating with staff, students, parents and regulators, and how critical services will continue.
Embed cyber security into AI governance
Schools, colleges and universities should not block innovation, but safe adoption requires clear ownership, approved tools, staff guidance and proportionate monitoring.
How we can help
The education sector does not need to become fearful of AI, but it does need to recognise that it is enabling faster, automated, and more convincing attacks. The institutions that respond best will be those that treat cyber security not as an IT issue, but as a core part of protecting learning, trust and continuity.
If your institution is reviewing its cyber resilience, AI governance, staff awareness training or incident response arrangements, we can help you identify the risks that matter most and develop practical steps to protect learning, data and continuity. To discuss how we can support your organisation, please get in touch with Erin Sims or Richard Curtis.