Phishing, Ransomware and AI Threats: The Cyber Security Checklist Every West Midlands School Should Have in 2026

Ransomware and phishing rarely make the local news when the victim is a school, but the Department for Education’s cyber security standards exist because incidents are common enough to warrant a formal response. Academia was named among the sectors most affected by ransomware in the National Cyber Security Centre’s 2025 Annual Review, alongside finance, engineering and manufacturing. This piece sets out a school cyber security checklist UK schools, colleges and multi-academy trusts can use to see where they stand, plus the staff training and common mistakes that decide whether that checklist holds up.

The biggest cyber threats facing UK schools in 2026

Phishing remains the entry point for most incidents. The Cyber Security Breaches Survey 2025/2026 found that 73% of secondary schools, 88% of further education colleges and 98% of higher education institutions had identified a breach or attack in the past year, all well above the 43% rate reported by businesses overall. Ransomware sits behind much of the serious disruption. Legacy systems, the volume of personal data schools hold on children and families, and the high tempo of attacks (weekly incidents at close to three in ten higher education institutions) all combine to make the sector a consistent target.

AI is changing the shape of the phishing emails themselves rather than the underlying threat. Messages that once gave themselves away through poor spelling now read as fluent, personalised and plausible, which raises the bar for what staff training needs to cover.

The school cyber security checklist UK institutions should have in place

The DfE’s and NCSC’s cyber security standards for schools and colleges set out the baseline. In practice, this means:

• Backups you can restore. Follow the 3-2-1 rule: three copies of your data, stored on at least two different types of media, with one copy held offsite (for example, a cloud backup service). Members of the risk protection arrangement should check their terms, as this level of backup is often a condition of cover.
• Multi-factor authentication on every staff account, with particular attention to finance, HR and senior leadership logins.
• Email is configured to reduce spoofing and imitation messages, so a fake message from “the headteacher” is harder to send convincingly.
• An annual cyber risk assessment, with a light-touch review every term.
• A tested incident response plan, including who reports to Action Fraud and when.
• Governor-level oversight, using the NCSC’s Cyber Governance Code of Practice as the reference point for the questions a board should be asking.

Working through these six areas gives a school or trust a realistic picture of where the gaps sit. Antivirus software alone is not the baseline the DfE standards describe.

Staff awareness training

Technical controls only work if the people using the systems don’t undo them. The NCSC provides a free training package for school staff covering the basics of phishing and password security, and the DfE standards treat this as a minimum expectation for anyone with a school email address.

A single annual video meets that minimum, but it isn’t the same as ongoing phishing training for staff in schools. Recognising a scam depends on recent exposure to realistic examples, not a memory of a video watched twelve months ago. Regular, varied security awareness training for teachers and support staff, delivered through short simulations, is what changes behaviour day to day. MT Services’ Security Awareness Training is built around that kind of ongoing rhythm, with regular short simulations that keep staff current between formal sessions.

Common mistakes schools make with IT security

The most frequent mistake is treating cyber security as solely an IT department problem. The DfE standards are explicit that a senior leadership digital lead and governors both have a role, working alongside whoever manages the network day to day. A second common gap is completing the annual risk assessment once and not revisiting it each term, even though the standards specifically call for that cadence. Backups are often in place but untested, so nobody discovers a restore doesn’t work until the day it’s needed. Multi-academy trusts sometimes assume a central IT function owns everything when individual schools still need local visibility over their own accounts and devices. Finally, plenty of schools rely on the free NCSC video as their entire training programme, without the recurring simulations that keep awareness current between sessions.

How MT Services helps education institutions stay protected

MT Services has supported organisations across the Midlands for over 50 years from its Tamworth base, and cyber security for schools and trusts draws on the same practical, hands-on approach used across its wider client base. That includes Multi-Factor Authentication, Cyber Essentials guidance, Email Security Services and the Security Awareness Training programme referenced above, alongside a free external penetration test to give a school a clear, no-obligation view of its current exposure. For schools looking for IT support in the West Midlands that understands both the DfE standards and the day-to-day reality of a busy school office, that combination of technical controls and ongoing staff training is the practical starting point.