Why it matters
Universities are targeted for research data, personal data and ransom. Open, decentralised environments make them difficult to defend.
Universities combine open networks, many users and valuable research. Protecting them requires identity controls, protection for the most sensitive data and plans to keep teaching and research running during incidents.
By the numbers
98%of UK higher education institutions identified a cyber breach or attack in the past year 1
73%of secondary schools did, up from 60% a year earlier 1
43%of UK businesses did the same 1
Higher education
Further education
Secondary schools
Primary schools
Businesses
Source: UK Government, Cyber Security Breaches Survey 2025/2026: education institutions findings, 30 April 2026
What's changing
- Ransomware has disrupted teaching, admissions and research.
- Research-security guidance addresses state-sponsored threats.
- Identity attacks target staff and student accounts.
How leaders are responding
- Enforcing multi-factor authentication for all users.
- Classifying and protecting sensitive research.
- Practising incident response with academic leadership.
What good looks like
- Multi-factor authentication for staff, students and researchers
- Research data and systems segmented from teaching networks
- Ransomware recovery rehearsed across the institution
What to watch
- Research-security guidance from governments.
- Identity and access controls for students and guests.
- Sector-wide cooperation on incident response.
Where to start
Identify the research projects and systems that would cause most harm if compromised, and prioritise their protection.
Questions for your leadership team
- Where is our most sensitive research data?
- Could we continue teaching during an outage?
- Who makes decisions during an incident?
