The NCSC advises: "there's no way to completely protect your organisation against malware infection." That's not a reason to give up, it's the reason defence-in-depth exists. Instead of relying on one control to stop everything, you build multiple layers, so that if one fails, the next one catches it, and if an attacker does get in, the damage is contained and recovery is fast.
Ransomware headlines tend to focus on big retailers, hospitals, and government agencies. But schools and colleges are an escalating, and in some ways more vulnerable, target, and a recent case shows exactly how indiscriminate the threat is.
A well thought-out plan gives you a structured approach to improving your security posture, identifying weaknesses, and ensuring a rapid response when an incident occurs. The goal is moving from reactive panic to proactive preparedness, and that starts with understanding exactly where you stand today, before building the plan and risk register that gets you further.
Across this series we've covered voice cloning, synthetic video, and AI-crafted phishing, three ways attackers are getting better at looking legitimate. But there's a quieter problem that does just as much damage: people notice something's wrong, and don't say anything.
Phishing remains one of the most prevalent and effective cyberattack methods, tricking millions into compromising their data every year. These deceptive messages, often arriving via email, text message (smishing), or phone call (vishing), are designed to look legitimate. They aim to trick you into revealing sensitive information like login credentials, credit card numbers, or personal data, or to click on malicious links that install malware. They may also be the start of a more complex cyber attack as a way into a system.
Yesterday we looked at voice cloning. Today's threat is more visually convincing : synthetic video. AI-generated footage that can show someone saying or doing something they never did, sometimes convincingly enough to fool the naked eye in real time.
This week, we're turning our Cyber Security Awareness Month series toward one of the fastest-growing threats facing schools and trusts: AI-generated deepfakes, starting with audio and voice cloning scams.
Cyber security can look like an IT problem, something for someone else to handle. It isn't. DPE has created as set of resources as a starting point to help you work out, role by role, who is accountable, who does the work, who should be consulted, and who just needs to be kept informed. Almost everyone in a trust or school appears somewhere on that list. That's the whole idea behind this year's theme: don't make it easy for them. Attackers rely on someone assuming it's not their job.
Cyber security and data protection sit side by side. Cyber security protects the systems; data protection governs what happens to the personal data inside them. In a school, that data is mostly about children, so the stakes are higher than in most sectors.
Yesterday we looked at why cyber security matters. Today we look at the people who protect personal data every day, and why an annual training module on its own rarely changes what they do.
October is Cyber Security Awareness Month, and this year's theme is "Don't Make It Easy for Them".
We don't think cyber security awareness is something to cover just once a year, but this month gives us a focus. Every day in October we'll share a short topic and one practical action you can take straight away.
Annual data protection training works well for core staff, but it often misses the people who arrive at short notice or whose roles don't look like "data" jobs: supply teachers, cleaners, caretakers and contractors. These staff still see personal data every day, and they share their own with your organisation too. Our new training pack is built for them, including a free Quick Guide for Emergency & Supply Teaching Staff developed with Garth Hill College.
©2026 Data Protection Education Ltd.