FE Leaders must be Proactive in Securing their Institution Against Cyber Threats 

To coincide with Jisc’s session at the Association of Colleges (AoC) annual conference, Mark Tysom sets out clear guidance for FE leaders to enhance their institutional cyber security posture 

The UK further education sector is facing an unprecedented wave of cyber threats, with 88% of providers reporting a cyber incident in the last 12 months. This rate is more than double the proportion seen in the wider business sector, where 43% of businesses reported incidents, highlighting FE institutions as frequent targets for digital criminals (source DSIT cyber breaches survey 2025-26) 

As technology continues to evolve faster than ever the ability of both state actors and cyber criminals to harness new technologies is rapidly determining their effectiveness. For FE leaders, understanding this shifting landscape and addressing critical resource gaps is no longer just an IT issue, it is a matter of business resilience. 

The anatomy of the threat: AI and social engineering 

As reported in the recently released National Cyber Security Centre’s (NCSC) State of the Cyber Nation report, technology has always influenced cyber security, but what sets today’s landscape apart is the sheer pace of change. Threat actors are actively using AI, automation, and advances in computing power to rapidly identify system vulnerabilities and target victims with accuracy and efficiency. 

For the sector, this technological leap mainly translates into two specific types of highly sophisticated attacks: 

• The Phishing Epidemic: As captured in DIST’s Cyber Breaches Survey, 96% of FE colleges reported phishing attempts over the past year. 
• Social Engineering: The single biggest threat facing institutions – designed for targeted phishing or credential theft. Armed with AI tools, attackers can now craft highly convincing, flawless communications tailored to trick recipients into handing over network access. 

The strategic value of data and insight 

Data and empirical insight are critical strategic anchors required to move FE institutions from a reactive security model to a proactive state of cyber resilience. Participating in sector-wide data initiatives, such as Jisc cyber security self-assessment and benchmarking survey, unlocks two key layers of critical insight: 

• Internal compliance and metrics: Mapped directly to the NCSC’s cyber assessment framework  the survey gives colleges a practical, low-friction mechanism to evaluate their institutional cyber posture. Completing it also fulfils mandatory annual self-assessment clauses within the Janet Network security policy. 
• Anonymised Peer Benchmarking: Leaders can clearly compare and contrast their approach with colleges of similar scale, identifying whether their security maturity needs attention, meets the sector baseline or is leading the pack. This provides valuable insights that help inform business cases for securing funding for staffing, defensive infrastructure and training. 

The resource divide, dedicated staffing and governance 

Results from Jisc’s 2025 cyber benchmarking survey highlight a stark operational disparity within UK tertiary education: while 92% of higher education providers benefit from dedicated internal cyber security teams, only 37% of FE colleges employ dedicated cyber security personnel. In most FE environments, cyber responsibilities are absorbed by general IT managers. This resource deficit means the majority of FE colleges rely on non-specialist staff to defend against highly sophisticated attacks. 

However, as reported in the DSIT cyber breaches survey, it is encouraging to see progress being made at the leadership level with 82% of FE colleges ensuring a board member, trustee, governor, or senior manager takes explicit responsibility for cyber security.  

Translating executive accountability into practical defence continues to pose a challenge when deep technical expertise is scarce on the ground. 

Bridging the gap: Collaboration and guidance 

Academic institutions play a critical role in strengthening collective cyber defence. For FE leaders looking to bolster their posture despite limited resources, looking outward for support is essential. 

Currently, only 67% of FE colleges seek external information or guidance (compared to 74% of primary schools, 76% of secondary schools, and 94% of HE institutions). 

Understanding where to find information and support is key and the more FE providers make connections with others, take action based on key sector guidance, and start to think of cyber security as a collective effort rather than an individual struggle, the more secure the sector will be. 

Key actions for FE Leaders to bolster institutional cyber posture: 

• Engage the board: If your college is one of the 18% without executive-level oversight, appoint a cyber security champion to the board to oversee risk. Make use of dedicated resources from the NCSC such as the free online Cyber Governance Training to enhance cyber skills within your institution. 
• Focus on the human element: Since social engineering and phishing represent 96% of the threat vector, continuous, up-to-date awareness training for staff and students is a cost-effective shield. In addition, ensure those responsible for responding to an incident fully understand their roles and conduct regular rehearsals of major incident plans. 
• Leverage sector partnerships to defend as one: If you are concerned about the limitations of your in-house security capabilities or just want to gain further insight and collaborate with peers reach out to Jisc and sign up to our dedicated cyber community of practice to access threat intelligence and advice and guidance tailored for education.  
• Make use of the right external resources: Use Jisc’s recently launched 16 questions you need to ask to assess your cyber security posture guide for leaders to initiate and enhance effective in-house security conversations, and ensure your organisation has completed the Jisc annual cyber posture and benchmark survey before the closing date on 11 December 2026 to continue to contribute to the overall cyber health of both your institution and the wider sector.  

By Mark Tysom, Senior Product Manager in the Core Security Services Team at Jisc