Don't Forget Your Cybersecurity Homework: Britain Expands Cyber Education in Schools

In the past year, 73% of secondary schools across the UK identified a cybersecurity breach or attack, according to government figures published in April 2026. That compares with 60% the previous year. Among primary schools, the figure was 49%, rising to 88% of further education colleges and 98% of universities.¹

The numbers are striking, although they require some perspective. Not every reported incident involved a successful intrusion or stolen information. Phishing accounted for the overwhelming majority of threats identified by schools, and institutions with better monitoring may simply be more likely to notice suspicious activity. Nevertheless, one in five secondary schools reported encountering incidents at least weekly, while 11% said they experienced them daily.¹

Cybersecurity has become a routine part of running an educational institution. School networks now support everything from classroom teaching and administrative records to communication with parents and the management of sensitive personal information. Protecting those systems is no longer something that can be left entirely to the IT department.

The government figures also suggest that schools are taking the issue seriously. Around 90% of secondary schools reported having formal cybersecurity policies, up from 81% the previous year. Yet there are gaps. Only 62% had policies for applying security updates within 14 days, and fewer than half (48%) covered supply-chain security as set out in the government's guidance.¹

Meanwhile, another change is taking place in British education. Rather than treating cybersecurity solely as a specialist profession, the government is expanding opportunities for children to learn how digital systems work, how they can be compromised and what it takes to protect them.

On 1 September 2026, CyberFirst, the National Cyber Security Centre's long-running programme for developing young cybersecurity talent, formally became part of TechFirst, a wider government initiative covering artificial intelligence, computing, semiconductors and other emerging technologies. The NCSC continues to lead the cyber pathway.²

CyberFirst had been operating since 2016, introducing young people to cybersecurity through competitions, practical challenges, summer courses and career development opportunities.⁵ Its move into TechFirst does not mean that Britain has suddenly introduced compulsory hacking lessons, but it does mark a significant expansion in the government's approach to technology education.

Announced in June 2025, TechFirst is backed by £187 million in funding across its wider activities.⁴ The government wants the programme to reach one million secondary-school pupils by 2029, including 400,000 in disadvantaged schools.^3,5 From September 2026, the initiative was intended to have a presence in every UK region and home nation, with regional delivery partners connecting schools to employers, training providers and technology organisations.³

There are practical changes behind the announcement. The Ada Computer Science platform, developed by the Raspberry Pi Foundation in partnership with the University of Cambridge, is being expanded to provide free computing and technology resources for pupils aged 11 to 19. The former CyberFirst Girls' Competition, which ran from 2016 to 2025, has become the TechFirst Girls' Competition, with new challenges spanning AI, semiconductors and quantum computing. Registration runs until 10 November, and the competition starts on 11 November.³

For younger pupils, programmes such as Cyber Explorers already provide a more hands-on introduction to security, using interactive challenges to explore digital threats and the techniques used to investigate them.

It is cybersecurity education with a little more imagination than another lecture about choosing a strong password.

But the expansion also raises questions about what is actually new, and how much difference it will make in classrooms.

CyberFirst was already an established programme. According to a government procurement notice published in 2026, it had reached 415,000 young people since 2016. By the end of June 2025, Cyber Explorers alone had nearly 129,000 registered learners in 3,375 schools.⁵

TechFirst is therefore building on a substantial existing infrastructure rather than starting from scratch. Its new regional partnerships, broader subject coverage and additional resources may help reach more pupils, but the September transition should not be confused with the introduction of an entirely new national curriculum.

There is also the question of who those opportunities reach.

An independent evaluation of CyberFirst, published by the government in 2021, found that 76% of participants in its Summer Courses had previously taken part in cyber courses or events. For its Development Days, the figure was 92%.⁶

The evaluation concluded that the programme "largely functioned as an existing part of a pipeline for the already engaged", rather than introducing large numbers of young people to the subject for the first time.⁶

That is not necessarily a failure. Developing existing talent was part of CyberFirst's purpose, and the evaluation found a significant increase in the proportion of Summer Course participants who said they were very likely to consider a cybersecurity career. Interviewees also felt the programme had challenged stereotypes and attracted more female students, although the survey itself showed no change in the view that cyber careers suit men more than women.⁶

But the research identified another concern: both the Summer Courses and the Development Days engaged young people in less deprived areas considerably more than those in more deprived ones.⁶

For a government programme now placing particular emphasis on reaching disadvantaged schools, that finding is difficult to ignore.

The challenge is not simply whether TechFirst can attract a million participants. It is whether the expansion can reach children who would otherwise have little exposure to practical cybersecurity or the careers associated with it.

There is an important difference between giving additional opportunities to pupils already enthusiastic about technology and introducing the subject to someone whose school has never hosted a cybersecurity workshop.

And participation figures alone may not tell us which is happening.

The government's own Digital and Technologies Sector Plan update reported that TechFirst had reached more than 100,000 young people since June 2025. But that figure adds together several programmes, and the methodology acknowledges that participants may overlap, meaning it is not a count of unique individuals.⁷

The eventual million-pupil target will therefore need careful interpretation. A pupil attending a single event and another completing sustained practical training may both count as participants, despite receiving very different experiences.

Industry involvement presents another challenge. TechFirst relies partly on relationships between schools, employers and regional delivery organisations. Yet the government's 2026 cybersecurity labour-market research found that while 64% of cybersecurity firms knew about CyberFirst, only 30% were aware of TechFirst.⁸

That may reflect the programme's relatively recent introduction. Nevertheless, it suggests that the government has work to do in explaining the new initiative to the very industry expected to help deliver some of its opportunities.

There is a further question about cybersecurity's place within the expanded programme. CyberFirst was designed specifically to encourage interest in cyber skills and careers. TechFirst now places those activities alongside AI, quantum technologies, semiconductors and a broader range of digital subjects.

That could be beneficial. Pupils interested in one area may discover another, while cybersecurity becomes part of a wider understanding of how modern technology operates.

Equally, the expansion raises a question about depth. How much meaningful cybersecurity education will an individual pupil receive within a programme covering so many different fields?

For those working in the industry, the distinction matters. Recognising a phishing email is useful, but it is not the same as understanding network security, cryptography, vulnerability research or incident response. Each has a place in education, although they require different levels of teaching and practical experience.

The British approach is not entirely unusual internationally. Other countries also combine cybersecurity awareness in schools with competitions and specialist training. What makes the current UK development newsworthy is the scale of its planned expansion and the integration of an established cybersecurity programme into a broader national technology education effort.

It also reflects a wider shift in how cybersecurity is understood.

For years, much of the public conversation has focused on developing enough specialists to protect businesses, governments and critical infrastructure. That remains important. But digital security increasingly affects people who will never work in the industry.

Future nurses, journalists, teachers, engineers and small-business owners will all encounter systems that hold personal information, process financial transactions or depend on services they do not directly control. Some understanding of digital security is becoming relevant to an enormous range of professions.

The question is how much of that understanding should be taught at school, and what form the education should take.

TechFirst's primary stated purpose remains developing technology skills and widening access to career opportunities. It should not be mistaken for a comprehensive national programme of everyday cybersecurity literacy, nor as a direct response to the attacks identified in the government's education survey.

Schools still need properly maintained networks, trained staff, effective security policies and resources to manage incidents. Teaching children cybersecurity cannot substitute for any of those requirements.

But the developments do sit alongside one another in an interesting way.

At a time when more schools are identifying cyber threats, the government is expanding a programme intended to give young people a better understanding of the technologies that underpin modern life. Some may become cybersecurity professionals. Others may simply leave school better equipped to recognise risks and make informed decisions about the systems they use.

Whether TechFirst delivers on that wider potential will depend on more than its funding announcement or the number of pupils who take part.

CyberFirst spent a decade building pathways into cybersecurity. Its independent evaluation showed both the value of that work and the difficulty of reaching young people who were not already interested.

TechFirst now has the opportunity to test whether those pathways can be widened. The more revealing measure may not be how many children complete a challenge or attend a workshop, but how many discover an interest, develop a useful skill or encounter an opportunity that their school could not previously offer.

Britain is expanding the place of cybersecurity in education. The next question is what that expansion will actually look like for the children sitting in its classrooms.