At the start of every school year, schools, colleges and universities across the UK race to onboard thousands of new students, faculty and staff members, provisioning accounts, issuing credentials and connecting a wave of new devices to institutional networks.
That operational pressure creates opportunities for attackers, and this year, AI is amplifying the threat more than ever. Not only are phishing campaigns more convincing, but a hidden layer of unmanaged machine identities is expanding the cyber attack surface.
Attackers are persistent and the education sector remains a top target with many facing cyber attacks weekly. The UK Government’s cyber security breaches survey revealed that 27% of further and higher education institutions reported experiencing a breach or attack at least weekly, compared to 14% of primary schools and 20% of secondary schools.
The education sector is one of the highest targeted industries for ransomware, credential theft and data breaches. For hackers, schools and universities present an appealing combination of high-value data, including student records, financial information and research, alongside underfunded IT departments and an enormous, ever-rotating user base.
The back-to-school season intensifies this pressure. Bulk account creation, mass device enrolment and a surge of third-party application onboarding all happen simultaneously, creating a greater risk of misconfiguration and excessive access rights. The UK Government found that no tier of the education sector had a majority of institutions compliant with all of the government’s Cyber Security 10 Steps.
Just 14% of primary schools, 23% of secondary schools, 33% of further education colleges and 45% of higher education institutions had covered all 10. As thousands of new identities and devices enter this already insecure environment, gaps in security controls can become harder to identify and manage.
AI has made cybersecurity threats significantly more dangerous. The same government survey found phishing to be the main threat identified by institutions that had suffered a breach, and those emails can now precisely mimic communications from student funding offices, IT helpdesks or university leadership, with none of the traditional red flags that once made them easy to spot.
Keeper Security’s research into AI and cybersecurity in education found that 41% of schools have experienced AI-related cyber incidents, including phishing and misinformation, while 90% of education leaders expressed concern about AI-related cybersecurity threats. Yet only one in four respondents felt very confident recognizing AI-enabled threats such as deepfakes or AI-driven phishing.
As AI makes social engineering attacks more convincing, education institutions need to reinforce human awareness with stronger identity and access controls that do not rely on users spotting every malicious message.
The hidden attack surface: non-human identities in EdTech
As students and staff begin the new academic year, IT teams will rightly be focused on securing human accounts, but there is another, much larger population of digital identities that can easily escape attention: Non-Human Identities (NHIs).
NHIs are now embedded throughout modern education environments, from service accounts that synchronize student records with learning platforms to API keys connecting third-party applications, digital textbooks and payment systems.
Machine identities and certificates authenticate everything from campus Wi-Fi and smart boards to lab equipment and security cameras, while cloud workloads automate backups, research pipelines and administrative processes. Similarly, AI agents powering admissions chatbots, helpdesks and grading tools are adding yet another layer of identities and access privileges that institutions need to manage.
These identities are essential to keeping schools and universities running, but they can also create significant security gaps when credentials are rarely rotated, old integration tokens remain active or automated accounts are granted more access than they need.
Unlike employees and students, NHIs are not naturally caught by onboarding and offboarding processes. Without a complete inventory, organizations can struggle to know which identities exist, who owns them and what they can access.
The cybersecurity conversation in education has historically centered on protecting students, teachers and administrators, but the machine identities powering modern EdTech deserve the same scrutiny, because regardless of whether a breach stems from a human or machine, the impact is the same.
Back-to-school is a useful opportunity to review the full identity estate – both human and non-human – remove identities that are no longer required and tighten access for those that remain.
How education IT teams can reduce their risk
For most institutions, the fundamentals of managing humans are manageable. The critical gap is visibility and governance over the NHIs that power modern EdTech, like service accounts, API tokens, machine certificates and AI agents that multiply with every new integration. Security teams should take these steps to help secure NHIs and humans alike.
Enable multi-factor authentication
As the new semester begins, organizations should ensure MFA is enforced across all faculty, staff and student accounts, with new users defaulted into it from the moment they are provisioned. MFA remains a fundamental defense against credential-based attacks.
Many accounts give users privileged access beyond what’s necessary for their role. Privileges should be audited for both humans and non-humans. This includes removing access for departed employees and students, retiring expired service accounts and eliminating unnecessary administrative privileges.
Deploy enterprise password managers
Password security remains one of the hardest problems for security teams to solve. Awareness and training can provide students, faculty and staff with the knowledge on how to create strong passwords, but converting that knowledge into practice is difficult because password reuse, written passwords and browser storage remain common. Enterprise password managers remove that gap, enabling users to create and store strong, unique credentials.
Build a non-human identity inventory
You can’t secure what you can’t see. Schools should catalogue every service account, API key, machine certificate, cloud identity and AI agent. Establish ownership and record what each identity can access.
Establish credential rotation policies
It’s important to establish credential rotation policies for machine identities, paying particular attention to AI agents and third-party EdTech integrations added for the new school year. The Canvas learning management system hack, reported in April 2026, affected almost 9,000 educational institutions globally – a reminder that third-party credentials require the same rotation discipline as internal accounts.
Third-party access should be regularly examined and security teams should scrutinize the security of all current and potential partners and suppliers.
Security awareness training needs to keep pace with the threat landscape, particularly around phishing, where AI-generated messages may be indistinguishable from legitimate institutional communications. Staff should independently verify unusual requests rather than relying on visual cues alone
Back-to-school will always put education IT teams under pressure, but it does not have to create an open window for attackers. As institutions begin the new academic year, security must extend beyond onboarding students and staff to understanding every identity with access to critical systems and data.
Security should be treated as a continuous discipline, not a back-to-school checklist. It is critical that every human and machine identity has the right access, for the right purpose and for only as long as it is needed.
We’ve featured the best antivirus software.
This article was produced as part ofTechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:https://www.techradar.com/pro/perspectives-how-to-submit
