England's schools are getting better at mopping up cyber incidents

Ofqual found that 27% of English secondary schools reported a cybersecurity incident in 2025/26, down from 29% in 2024/25 and 34% in 2023/24, while 66% of affected schools recovered immediately versus 55% a year earlier. Reported critical damage fell to 7% from 10%, although phishing remained the leading incident type and staff data was most frequently compromised. The improvement is tempered by weak cyber preparedness: roughly one-third of teachers had no or unknown training, 54% did not know of any school security improvements, and a broader government survey found 73% of UK secondary schools identified a breach or attempted attack.

Analysis

This is not evidence of a weakening education-security spend cycle: the survey measures visible, successful disruptions rather than the broader attack volume that drives prevention budgets. Faster restoration is more likely to reflect basic resilience investments—cloud identity, endpoint management, backups and outsourced incident response—than a lower threat environment. That favors platform vendors with bundled endpoint, identity and recovery capabilities, including Microsoft (MSFT), Palo Alto Networks (PANW) and CrowdStrike (CRWD), while constraining the pricing power of point-product vendors selling solely on breach prevention.

The more investable signal is governance maturity, not incident frequency. Education buyers remain highly budget constrained, so the next 6-18 months should favor vendors that convert compliance, training and managed detection into recurring subscriptions or channel-led packages; Fortinet (FTNT) is relatively exposed to lower-cost appliance-led procurement, whereas MSFT can monetize through existing productivity and identity estates. A material rise in public-sector procurement frameworks, ransomware disclosures, or mandatory resilience standards would accelerate demand, but absent those catalysts this is insufficient to change near-term sector estimates.

Consensus may incorrectly interpret better recovery metrics as proof that cyber risk is receding. In practice, improved recovery can reduce downtime costs while increasing willingness to report and contain attacks; the residual vulnerability is human and governance-driven, which supports security-awareness, identity and managed-services demand more than large incremental firewall deployments. The thesis is falsified if UK education and local-government IT budgets contract materially, or if PANW/CRWD/MSFT commentary shows public-sector seat growth and net retention decelerating rather than merely shifting toward bundled offerings.

Key Decisions for Investors

• No standalone trade on this survey; treat it as a watch item rather than a demand inflection, given weak comparability of incident definitions and no disclosed procurement data.
• Over a 6-18 month horizon, retain a relative preference for long MSFT versus short FTNT if public-sector cyber budgets remain resilient: MSFT has identity, endpoint and productivity distribution advantages, while FTNT faces greater exposure to lower-ticket network-security purchasing. Reassess if FTNT billings or secure-networking backlog materially outgrows MSFT Security revenue growth for two consecutive quarters.
• Use any 10-15% sector-driven pullback in CRWD or PANW to build exposure only after verifying public-sector pipeline commentary and net-new ARR/billings momentum; target a 12-month 2:1 upside/downside profile, with thesis invalidation on guidance cuts tied to government or education demand.
• Monitor UK cyber-resilience mandates, education procurement notices and ransomware-related school closures over the next 1-3 months. A policy-driven requirement for tested backups, incident response or staff training would be a positive catalyst for PANW, CRWD and MSFT, but should not be front-run without contract evidence.