Your Cyber Threat, Your Cyber Landscape
Over the last few years, I have had the opportunity to work with organisations across Higher Education, Further Education, healthcare, diagnostics and other regulated sectors. Much of that work has focused on helping leadership teams understand cyber risk, improve operational resilience and strengthen the security capabilities that sit behind modern digital services.
One observation consistently stands out.
When a cyber incident occurs, the challenge is rarely a lack of technology. More often, it is a lack of visibility, clarity or understanding of where responsibility sits, how risk is being managed and whether the organisation's existing security capability is genuinely aligned to its threat landscape.
In education, this challenge is particularly significant. Institutions are balancing increasing digital dependency, constrained budgets, complex regulatory requirements and a growing cyber threat environment. At the same time, technology teams are asked to deliver more services, support more users and manage increasingly sophisticated attacks.
The purpose of this article is not to promote a particular security model or suggest there is a single right answer. Instead, I want to encourage leadership teams to ask the important questions:
Do we really understand the cyber security capability we have today?
Is it sufficient for the risks that we face?
Understanding where your organisation sits on its cyber maturity journey is often the first step towards answering that question. Over the last six months alone, I can name six cyber incidents within the UK education sector that have been publicly reported and all were significant in their own right. As these incidents are already part of the public record, it feels unnecessary to repeat them here.
What is important is understanding their impact. Across those incidents we have seen:
School closures due to malware and virus events
Student and staff data breaches
Third-party supplier compromises affecting educational platforms
Identity and credential theft
Operational disruption during teaching, admissions and assessment periods.
These are not simply cyber security events. They directly affect an institution's ability to deliver education, support students, protect personal data, maintain regulatory compliance and preserve trust amongst staff, parents and stakeholders.
Government data published in April 2026 highlighted just how widespread this challenge has become. The Cyber Security Breaches Survey found that 98% of Higher Education institutions, 88% of Further Education colleges and 73% of secondary schools identified cyber breaches or attacks during the previous 12 months. The same report found that over one quarter of Further and Higher Education institutions experienced attacks at least weekly, while around one in ten reported attacks daily.
The reality is that cyber threats are no longer an occasional event. They are part of modern operational life. For today's IT teams, cyber security is not a separate activity performed once a year during an audit. It has become a daily discipline. This often includes:
Vulnerability management
Security monitoring and log analysis
Asset lifecycle management
Identity and access management
Third-party risk management
Discovery and control of Shadow IT
Incident response planning and testing.
As educational institutions continue to digitise teaching, administration, research and student services, the complexity of defending those environments increases.
However, leadership teams face a different challenge.
In board meetings, I rarely encounter organisations with no cyber security capability whatsoever. What I encounter are organisations that have cyber security capability they do not fully understand. Leadership teams often assume that they have a dedicated security function when in reality, they have a handful of capable individuals carrying security responsibilities alongside their day job.
Understanding that distinction is critical because your exposure to cyber risk is often determined as much by organisational structure as it is by technology investment.
So what cyber security structure do you actually have?
In practice, I typically encounter three common operating models:
1 Security as an Additional Responsibility
In many organisations, cyber security has evolved organically. You may have a long-serving IT team where security responsibilities have gradually been assumed by senior technical staff. Often these individuals have developed security expertise through genuine interest and experience rather than through a dedicated security function. There is nothing inherently wrong with this model. In fact, it often creates strong operational understanding and close integration with day-to-day IT delivery.
However, there are limitations. Security activities can become heavily dependent on key individuals. Formal governance may be limited. Security monitoring may only occur alongside other operational priorities. Reporting to senior leadership can also become highly technical rather than risk-focused. The key question for leadership is:
Are you relying upon capable people, or are you relying upon a defined cyber security capability?
Those are not necessarily the same thing.
2 Outsourced Security Services
The second model involves outsourcing some or all cyber security activities. This may include a Managed Security Operations Centre (SOC), Managed Detection and Response (MDR) services, vulnerability management providers or broader cyber security consultancy support. This approach can provide access to expertise that may be difficult or expensive to recruit internally. It can also provide round-the-clock monitoring that many education institutions simply could not deliver themselves.
However, outsourcing does not remove accountability. One of the most common misconceptions I encounter is the belief that cyber risk has been transferred because a supplier has been contracted. In reality, responsibility for cyber risk remains with the organisation. A provider can identify threats. They cannot make institutional risk decisions, deploy organisational change or determine priorities without direction from leadership. The critical question therefore becomes:
Do you understand where your provider's responsibility ends and your institution's responsibility begins?
3 Dedicated Cyber Security Function
At the most mature end of the scale sits the dedicated cyber security team. This may take the form of an internal Security Operations Centre, cyber security department or specialist security function operating alongside IT operations. These teams typically provide dedicated expertise across governance, assurance, vulnerability management, security monitoring, incident response, compliance and regulatory alignment.
The advantage is greater visibility, stronger governance and improved alignment with recognised frameworks such as Cyber Essentials Plus, ISO27001 and the NCSC Cyber Assessment Framework. However, maturity should not be confused with effectiveness. A well-funded cyber team that operates separately from IT, academic departments and operational leadership can still struggle to reduce risk if security becomes disconnected from the wider organisation. Cyber security remains a business function enabled by technology, not purely a technical function.
The Questions Leadership Should Be Asking
Every institution sits somewhere on this maturity journey. The objective is not necessarily to reach 3. For some organisations, 1 or 2 may be entirely appropriate given their size, budget and risk profile. The more important question is whether senior leadership understands where their organisation currently sits and whether that model is genuinely capable of managing the institution's evolving risk landscape.
Board members, executive teams and governing bodies should be asking:
Who owns cyber risk?
How do we know that our controls are working?
What risks are we consciously accepting?
What capability do we have internally?
Where are we dependent on individuals?
Where are we dependent on suppliers?
What would happen if a major cyber incident occurred tomorrow?
Are we investing in cyber security, or simply spending money on technology?
Cyber security is no longer just an IT discussion. The institutions that respond most effectively to future threats are unlikely to be those spending the most money on security. They will be the organisations that genuinely understand their cyber landscape, recognise their maturity level and make informed decisions about the risks they are prepared to accept. Because ultimately, the question is not whether cyber security exists within your organisation.
The question is whether leadership truly understands the cyber capability that they have, the risks it can realistically manage and the gaps that still remain.
#Universities #cybersecurity #HigherEducation #riskassurance #TOMS
