If you ask most schools whether they're protected against cyber attacks, the first answer is often "yes, we have antivirus". That's a good start, and it's a requirement. But antivirus is only one layer of protection, and many of the incidents that disrupt schools don't start with a virus at all. A stolen password, an old laptop that no longer gets updates, or a backup that won't restore can cause just as much trouble.
This guide is for headteachers, school business managers, trust leaders and governors. It explains what antivirus does, what the Department for Education (DfE) expects alongside it, and the practical questions worth asking your IT team or provider.
What antivirus does, and what it doesn't
Antivirus (or anti-malware) software looks for known malicious software and blocks or quarantines it. It is still worth having. The DfE's cyber security standard says anti-malware, including antivirus, should be installed on all devices, centrally managed, actively monitored and kept up to date.
What antivirus can't do is stop someone logging in with a member of staff's real username and password. It can't fix a security weakness in software that hasn't been updated. And it can't bring back data that has been deleted or encrypted. That's why the guidance from the DfE and the National Cyber Security Centre (NCSC) treats it as one layer among several.
What the DfE expects
The DfE's digital and technology standards include a cyber security core standard. The DfE describes it as its recommended approach to meeting schools' wider responsibilities. Schools also have a statutory duty, set out in Keeping Children Safe in Education, to keep children safe online, and that includes appropriate cyber security. The DfE Cyber Security Hub says schools should be working towards the standards by 2030.
Some requirements are firmer for particular settings. Cyber Essentials certification is a requirement for colleges under their funding agreement, and optional for schools. If your school is a member of the DfE's Risk Protection Arrangement (RPA), check your terms: the standard notes that its level of backups and having a cyber response plan are currently conditions of cover.
Within the standard, a few expectations stand out for school leaders.
Multi-factor authentication (MFA). MFA must be enabled for all staff accounts with access to cloud services or remote access to on-site systems, and for all IT administrative accounts. MFA means a second check, such as a code on a phone, as well as a password. It makes a stolen password much less useful to an attacker.
Security updates. Vulnerability fixes for operating systems, applications and firmware should be completed within 14 days of release where the vendor rates the issue as critical or high risk, where it scores 7.0 or above on the industry scale (CVSS), or where the vendor gives no rating. Devices also need to be licensed and supported, so it helps to know when equipment reaches its end-of-support date.
Backups that actually restore. The standard follows NCSC advice: at least three copies of important data, on at least two separate devices, with at least one off-site. It asks for backups that can't be changed once created, and for backups to be tested and logged each term, including a test restore.
People and planning. The standard also covers an annual cyber risk assessment reviewed each term, a cyber awareness plan for staff and pupils, controlling who has access to what, and a plan for responding to and reporting an incident.
A layered approach in plain English
It can help to think of cyber security as five layers:
- Accounts: MFA, separate admin accounts, and removing access promptly when people leave.
- Devices: supported, updated systems, with anti-malware on every device.
- Data: backups held separately and tested by actually restoring them.
- Watching: someone notices suspicious activity and acts on it.
- People and governance: staff awareness, a response plan, and regular reporting to governors or trustees.
No single product covers all five. Your IT team or provider should be clear about who is responsible for each layer, so nothing falls between the gaps.
EDR and MDR, briefly
You may hear two more terms. EDR (endpoint detection and response) goes beyond antivirus by recording what happens on a device, spotting suspicious behaviour and letting an analyst investigate or isolate the device. MDR (managed detection and response) adds a team of security analysts who watch those alerts and respond. Both strengthen the "watching" layer. Neither replaces updates, MFA or backups.
How Atom IT approaches it
At Atom IT, we protect managed Windows, macOS and Linux computers and servers with Cynet Protect as standard. It combines endpoint protection with basic EDR, network detection and user behaviour analytics. Cynet Protect doesn't include 24/7 MDR.
For schools and trusts that need broader cover, Cynet All-in-One is an optional upgrade. It adds full EDR, email security, identity protection, SaaS and cloud posture checks, and Cynet's own CyOps team providing 24/7 MDR.
Neither package replaces backups, updates or account security. Those still need to be planned and agreed as part of your wider IT support. You can read more about our cyber security options and school IT support. For online safety and filtering, see our guide to safer internet and KCSIE.
Questions to ask your IT team or provider
- Is MFA switched on for every staff cloud account and every admin account?
- How quickly are critical and high-risk updates applied, and how is that checked?
- Do we have devices that are, or soon will be, unsupported?
- When did we last test restoring a backup, and was it logged?
- Who watches for alerts, and what happens out of hours?
- Do we have a cyber response plan, and do staff know how to report something suspicious?
The NCSC publishes questions for school governors and trustees that are a useful starting point for board discussions.
Next step
Antivirus is necessary, but it isn't a cyber security strategy on its own. If you'd like to talk through where your school stands, talk to Atom IT about your school's cyber security.
Further reading: DfE cyber security standard · DfE Cyber Security Hub · NCSC guidance on antivirus
Want to talk this through?
Our team is happy to help, with no obligation.
