Most leadership teams assume backups are in place and working. In reality, very few have ever seen a full recovery under pressure, across every system that matters. The result is a dangerous gap between perceived assurance and actual resilience. Backups are often treated as a technical checkbox, when they should be treated as a critical, testable part of organisational risk management.

When organisations review their backup strategy, the conversation often jumps straight to tools and platforms.

• Cloud or on-premise.
• Immutable storage.
• Per-user licensing versus per-terabyte pricing.

But the quality of a backup solution is not defined by the platform you choose. It is defined by the planning you do before you choose it.

Without that planning, even the most advanced solution will leave gaps.

Start with risk, not technology

A good backup strategy starts with a simple but often overlooked question:

What are you trying to protect, and why?

This should be informed by:

• Previous experience of data loss
• Cyber security risks, including ransomware
• Physical and technical risks, including fire, flood, hardware failure and data corruption
• Insurance requirements, particularly cyber insurance expectations
• Business continuity needs and acceptable downtime

Backups are not just an IT function. They are a core part of organisational resilience and risk management.

Define what “good” looks like

Before selecting any platform, you need a clear definition of success.

That means understanding:

• What systems you have
  • Data and file stores
  • Servers (physical or virtual)
  • Cloud services and SaaS platforms
  • Operational systems such as telephony, door access and network infrastructure
• What needs to be backed up
  • End user data
  • Business-critical systems
  • Configuration and access controls
• How quickly you need to recover
  • Recovery Time Objectives (how fast systems must be restored)
  • Recovery Point Objectives (how much data loss is acceptable)
• How long data must be retained
  • Statutory requirements
  • Internal policies
  • Safeguarding and audit expectations

Too often, retention is an afterthought. In reality, it should be a primary design principle.

Align backups to retention policy, not the other way around

Retention requirements should drive your backup design.

For example:

• Safeguarding records may need long-term retention
• Financial records may have statutory retention periods
• Operational data may only need short-term recovery
• Loss of coursework and curriculum resources will impact pupil outcomes

If your backup platform cannot support these requirements, or makes them cost-prohibitive, then it is not the right platform.

A common failure is selecting a solution based on cost per terabyte, then reducing what is backed up or how long it is retained to control costs. This introduces risk silently and often unintentionally.

Understand the full scope of what needs backing up

A comprehensive backup strategy must consider the full estate:

• On-premise infrastructure
• Cloud platforms
• Hybrid environments

In modern environments, particularly in schools and multi-academy trusts, a large proportion of critical data sits in the cloud.

This introduces a key risk: assuming that cloud platforms are already fully protected against accidental deletion, data corruption or cyber attack.

In most cases, they are not.

What can typically be backed up from cloud platforms

• User files
• Email
• File permissions
• Sharing permissions
• Collaboration platform data and configurations

Understanding what cannot be backed up is as important as knowing what can be. You must not assume that everything is covered.

What often cannot be backed up

This is where many strategies fall short.

Certain elements are either not supported by backup tools or require manual processes, for example:

• Power Platform components
• AI agents and automation routines
• Some application configurations and workflows

These gaps must be explicitly identified and managed. If they are not, you do not have a complete backup strategy.

Plan for what cannot be backed up

Where systems or components cannot be backed up automatically, you need compensating controls.

This may include:

• Documented rebuild procedures
• Export routines where possible
• Configuration baselines
• Manual recovery playbooks

A backup strategy that ignores these elements creates a false sense of security.

Security matters as much as backup

Backing up data is only part of the challenge. Protecting those backups is equally critical.

Key questions to ask include:

• Are backups immutable and protected from tampering?
• Can malware or ransomware reach your backup environment?
• Is backup storage genuinely isolated from production systems?
• Does the platform scan for encrypted or suspicious data during backup?
• Are your backups protected from hardware failure, fire and flood.

If backups can be altered or deleted by an attacker, they cannot be relied upon in a recovery scenario. Suppliers should be asked for explicit confirmation of how backups are protected and if backing up on premise, you should be able to demonstrate how your backup data is protected from malicious attack.

Avoid fragmented solutions

Many organisations end up with multiple backup platforms:

• One for on-premise servers
• One for cloud services
• Separate tools for different systems

This creates:

• Complexity
• Increased cost
• Reduced assurance
• Dependency on specialist knowledge

Where possible, a unified approach with a single platform and dashboard improves:

• Visibility
• Consistency
• Ease of recovery
• Operational resilience

In multi-school environments, this becomes even more important, enabling central oversight while supporting individual sites.

Cost models shape behaviour

The way a backup solution is priced can significantly influence decisions.

• Per volume pricing can encourage reducing coverage or retention
• Per user or per pupil pricing can provide predictability and encourage full coverage

It is important to recognise these incentives and ensure cost does not drive risky decisions.

Alignment with DfE digital and technology standards

The points above are not just good practice. They align directly with Department for Education expectations for schools and trusts.

The DfE standards make several things clear:

• Backup and recovery must form part of a wider business continuity plan, identifying critical systems and risks
• Backup strategies must be tested, not assumed, to provide assurance that services can be restored when needed
• Schools should have a data backup plan that is reviewed regularly, typically at least annually as part of cyber security governance
• Cloud solutions must include appropriate data protection, availability and backup arrangements rather than relying on the platform alone

These standards reinforce a key message: backups are only meaningful if they are planned, complete and proven to work.

They also highlight a gap that often exists in practice. Many organisations:

• Have backups configured but not formally tested
• Rely on cloud retention rather than true recovery capability
• Cannot clearly demonstrate how all critical systems would be restored

From a DfE perspective, that is not sufficient.

The key takeaway

A backup strategy is not a product decision. It is a design decision.

The most important steps are:

• Define your risks and requirements
• Map your full estate
• Align backups to retention policies
• Identify and manage gaps
• Ensure backups are secure and isolated
• Test recovery regularly as part of business continuity planning

Only once those are clear should you choose a platform.

Because ultimately, the question is not:

“Do we have backups?”

It is:

“Can we confidently recover everything that matters, when we need to, and can we prove it?”

We recently brought together sector leaders and specialists for a webinar on cyber resilience in education. What emerged was not another technical conversation about firewalls and compliance checklists. It was a much more fundamental discussion about safeguarding.

If we are honest with ourselves, cyber security and safeguarding are no longer separate conversations. They are inseparable. And there are some uncomfortable truths that education leaders need to confront.

1. Cyber incidents become safeguarding failures

A serious cyber incident is not simply an IT problem. It is a safeguarding issue from the moment systems go down.

If a trust loses access to pupil data, care plans, safeguarding records or parental contact details, it loses its ability to coordinate support for vulnerable learners. If the systems that hold what many refer to as the grab bag are unavailable, staff cannot act with confidence or speed. That creates a material safeguarding risk.

Ransomware does not just lock files. It disrupts the operational fabric that protects children and staff. When we separate cyber risk from safeguarding risk, we create blind spots. They must be discussed together at board level, not in isolation.

2. We underestimate operational fragility

Many organisations still believe a cyber breach means a few days without laptops. The reality is far more complex.

A major ransomware attack can affect:

• Cloud-based telephony and critical communications
• Building Management Systems and door access controls
• Payroll and finance operations
• Catering systems and payment processes

If pupils cannot be charged for meals, the financial implications mount quickly. If access control systems fail, that becomes a site safety issue. If payroll is disrupted, staff confidence is damaged.

Modern education is deeply dependent on interconnected digital systems. Over time, workflows become automated and undocumented. When they fail, organisations discover just how much tacit knowledge has been embedded in technology. The gaps that appear are often deeper than expected.

Operational fragility is not theoretical. It is real, and it is growing.

3. Identity and suppliers are the real front line

The biggest risks are not always where we expect them to be.

Identity management has become central to how schools and trusts operate. Single Sign-On simplifies life for users and IT teams. But it also increases the blast radius. If one identity is compromised, access to multiple systems can follow.

We are also seeing compromised student accounts being used to phish staff and peers. That changes the threat model. The attacker no longer appears external. They appear familiar.

Then there is the supply chain. Catering providers, building management suppliers, outsourced services, all connecting devices and systems to the network. Each connection represents a potential entry point.

Too often, due diligence stops at contractual paperwork. Cyber maturity of suppliers is assumed rather than assured. In practice, that can leave an open door into core systems.

If we want to improve resilience, we need to treat identity and supplier governance as strategic priorities, not operational afterthoughts.

4. Compliance theatre is not resilience

Annual training sessions and policy sign-offs may satisfy an audit requirement. They do not create resilient organisations.

Ticking a box once a year is compliance theatre. It gives a sense of control without delivering it.

Real resilience is educational in the truest sense. It is:

• Continuous, delivered in small and regular interventions rather than a single annual event
• Contextual, grounded in real phishing attempts and real incidents experienced by the organisation
• Tested, using simulations and short assessments to identify higher risk users and support them properly

Cyber threats evolve constantly. Our approach to awareness must evolve too. If we treat it as a static compliance exercise, we will always be behind.

Moving from awareness to action

The conversation closed with a practical focus on partnership. Education organisations do not need more abstract guidance. They need accessible, specialist support that understands both safeguarding and cyber risk.

Models that provide enterprise-grade protection at a price point education can sustain are essential. The ambition should be simple. Deliver Tier 1 capability at Tier 3 commercials so that strong cyber resilience is not a luxury, but a baseline.

Transformation in education is digital by definition. Safeguarding in education must now be digital by design.

If we are serious about protecting learners and staff, cyber resilience has to move from the IT agenda to the leadership agenda. That is where real change begins.

On 18th June, TransforMATive, in partnership with Xentra, brought together a select group of education leaders, digital strategists, and cybersecurity experts from across England’s multi-academy trust (MAT) sector for a powerful roundtable dinner in Birmingham. The focus: Data Resilience in Educational Transformation — a theme growing ever more urgent as trusts scale digital systems, embrace AI, and face an increasingly complex threat landscape.

This was not a session about technology for technology’s sake. It was about responsibility, risk, and readiness. The discussions went far beyond the usual tick-box compliance mindset and instead tackled the deeper cultural and strategic challenges facing the sector. Together, we explored how cyber resilience is no longer a peripheral IT concern but a fundamental pillar of operational, reputational, and educational continuity.

Key Themes and Takeaways

1. Cybersecurity is Strategic
MAT leaders are rightly repositioning cyber risk as a strategic issue that impacts every area—from governance and learning to trust growth and community confidence. It must be owned from the top.

2. Culture Over Compliance
The sector is waking up to the limitations of surface-level schemes such as Cyber Essentials. True resilience demands an embedded culture—one rooted in awareness, ownership, and continuous learning.

3. Leadership is Pivotal
Cyber maturity is not achieved by IT teams in isolation. It requires executive sponsorship, cross-functional collaboration, and empowered technical leadership across the organisation.

4. Simulation Matters
Regular phishing simulations, tabletop exercises, and breach rehearsals were seen as essential tools in developing readiness and building confidence at all levels.

5. Secure by Design
Trusts must move beyond bolted-on security solutions. Instead, resilience must be baked into the design of systems, procurement processes, and digital transformation strategies from the outset.

Recommendations for Trust Leaders

• Secure senior ownership by appointing a board-level sponsor for digital risk.
• Invest based on maturity and threat, not just frameworks.
• Develop internal capability and independent assurance to avoid over-reliance on individuals or vendors.
• Embed cybersecurity as a life skill, not a policy.
• Plan for the inevitable, with a clear incident response playbook and 24/7 monitoring.

Looking Ahead

This roundtable reaffirmed the sector’s growing recognition that resilience isn’t about reacting to threats—it’s about building trust, safeguarding progress, and securing the future. As we continue to support trusts across the country, we remain committed to fostering the leadership, capability, and culture needed to navigate these challenges with confidence.

If your trust is ready to take the next step in its digital and cyber maturity journey, get in touch. We’d love to help.

AI Is Redrawing the Cyber-Threat Map – Highlights from the NCSC’s 2025 Assessment

The UK’s National Cyber Security Centre (NCSC) has released “Impact of AI on the Cyber Threat: Now to 2027.” It focuses on the next two years and warns that artificial intelligence is already tipping the scales toward attackers. Organisations that fail to adapt will slip into a widening resilience gap.

---

Why this report deserves your immediate attention

• Near-term, not sci-fi. The assessment stops at 2027, so its advice is usable right now rather than in some distant future.
• 360° evidence base. Findings blend incident telemetry, government intelligence and observable AI tooling trends, giving it more weight than a single-source study.
• Early-warning. NCSC sits at the nexus of national-security and critical-infrastructure defence; its signals often show up in commercial SOC logs months later.

---

Five hard truths every security leader must absorb

1. AI drops the “skill floor.” Generative phishing kits, deep-fake services and automated recon make it easy for amateur hackers to run polished campaigns. Expect both the volume and believability of commodity attacks to jump.
2. Ransomware still rules. Criminal crews are using large-language models to profile victims, craft extortion emails and even automate negotiation scripts, speeding up their entire playbook.
3. Patch windows are collapsing. AI-assisted vulnerability research is shrinking the time between CVE disclosure and exploitation and is likely to fuel more zero-days before 2027. Monthly patch cycles will soon be untenable.
4. A “digital divide” is opening. Organisations that cannot weave AI into defence will see resilience gaps widen across supply chains and critical infrastructure—concentrating cyber risk in the least-resourced sectors.
5. Incidents are already surging. The NCSC received almost 2 000 attack reports in 2024, and the most severe cases tripled year-on-year—a spike it directly links to adversarial AI adoption. Boards should treat AI-fuelled threat growth as a present, not future, risk driver.

---

From insight to action: a 24-month roadmap

• Shift to “AI-first” defence. Pilot LLM-backed phishing filters, anomaly-based EDR and model-assisted log triage so analysts can focus on high-value investigation.
• Harden the human layer. Replace dated awareness videos with simulations that use AI-generated lures, deep-fake voice snippets and realistic business-email-compromise scenarios. Rehearse no-ransom, rapid-restore playbooks before attackers force the issue.
• Bake “secure-by-design” into every AI project. Enforce model-provenance checks, red-team testing and ML supply-chain controls; document prompts, data lineage and guard-rails for auditability.
• Invest in talent or outsource. Consider the need for a security operations centre (SOC) to keep detection pipelines monitored and managed.
• Share intel, don’t silo it. Feed anonymised indicators and TTPs into your sector and track obligations under the forthcoming Cyber Security & Resilience Bill for safe-harbour protection.

---

Join the conversation

If you would like to understand how your MAT could improve its knowledge and awareness of Cyber, improve risk management then register to join our next roundtable on June 18th in Birmingham https://forms.gle/T8JDEFz2mWn5ZzxC9

Fresh from CYBERUK2025 in Manchester, we’re still absorbing a truly thought-provoking agenda. A huge thank you to the NCSC and all involved in curating such a rich and engaging event. It was great to connect with new voices, reconnect with sector leaders like James Garnett and Adam Holt (BlueVoyant), and immerse ourselves in the latest thinking on cyber strategy and resilience.

As we reflect on the experience, several powerful themes continue to resonate — all of which are deeply relevant to the challenges and opportunities we face across the education sector:

1. The Cost of Inaction
We were reminded that cyber resilience isn’t just about systems — it’s about consequences. Failures to implement basic controls like multi-factor authentication (MFA) have already resulted in regulatory fines. Often, the barrier is cultural, not technical — and outdated systems are exposing organisations to avoidable risk.

2. Cyber Governance is Evolving
The forthcoming Cyber Security and Resilience Bill signals a step change in expectations, requiring organisations to report material risks and controls in their annual reports. This shift will push cyber resilience up to board level, where it belongs — but we must also focus on moving beyond awareness to genuine engagement.

3. Privacy and Security by Design
Throughout the event, the message was clear: we must design for risk, resilience, and effectiveness from the outset. This is as much about organisational mindset as it is about frameworks — embedding cyber thinking into every transformation journey.

4. Procurement, Standards and Accountability
From Cyber Essentials to third-party risk, supply chains and procurement emerged as critical pressure points. Simply mandating standards isn’t enough — we need clear accountability, robust monitoring, and a commitment to building resilience across all layers of delivery. Check out the latest DfE Technology Standards for Cyber Security.

5. People are the Frontline
From team shift patterns to simulated crisis scenarios (including a superb crisis simulation by Google Cloud and Mandiant), it’s evident that strategy will only succeed if our people are equipped, supported, and empowered to act. Human resilience is just as vital as technical controls. Has your organisations leadership team exercised its Cyber Security and/or Business Continuity Plans recently?

These reflections will undoubtedly shape our continued work with Trusts and partners. As digital transformation accelerates, the importance of secure, resilient foundations has never been clearer.

Let’s keep the conversation going — and ensure we’re not just cyber-aware, but cyber-prepared.