UK education faces rising cyber risk from AI phishing and machine identities, TechRadar reports

The report says that at the start of every school year, UK institutions race to onboard thousands of new students, faculty and staff members, provisioning accounts, issuing credentials and connecting a wave of new devices to institutional networks. That operational pressure creates opportunities for attackers, and AI is amplifying the threat, with phishing campaigns becoming more convincing and a hidden layer of unmanaged machine identities expanding the cyber attack surface.

Education remains a top target. The UK Government’s cyber security breaches survey found that 27% of further and higher education institutions reported experiencing a breach or attack at least weekly, compared with 14% of primary schools and 20% of secondary schools. The sector is among the most targeted for ransomware, credential theft and data breaches, because schools and universities hold student records, financial information and research while often relying on underfunded IT departments and serving an enormous, ever-rotating user base.

The back-to-school season intensifies the pressure. Bulk account creation, mass device enrolment and a surge of third-party application onboarding happen at the same time, increasing the risk of misconfiguration and excessive access rights. The UK Government found that no tier of the education sector had a majority of institutions compliant with all of its Cyber Security 10 Steps. Just 14% of primary schools, 23% of secondary schools, 33% of further education colleges and 45% of higher education institutions had covered all 10. As thousands of new identities and devices enter this already insecure environment, gaps in security controls can become harder to identify and manage.

AI has made the threat more dangerous. The government survey found phishing to be the main threat identified by institutions that had suffered a breach, and such emails can now mimic communications from student funding offices, IT helpdesks or university leadership without the traditional red flags. Keeper Security’s research into AI and cybersecurity in education found that 41% of schools have experienced AI-related cyber incidents, including phishing and misinformation, while 90% of education leaders expressed concern about AI-related cybersecurity threats. Only one in four respondents felt very confident recognizing AI-enabled threats such as deepfakes or AI-driven phishing.

As AI makes social engineering attacks more convincing, the report says education institutions need to reinforce human awareness with stronger identity and access controls that do not rely on users spotting every malicious message.

The report also points to a hidden attack surface: non-human identities. These are embedded throughout modern education environments, from service accounts that synchronize student records with learning platforms to API keys connecting third-party applications, digital textbooks and payment systems. Machine identities and certificates authenticate everything from campus Wi-Fi and smart boards to lab equipment and security cameras, while cloud workloads automate backups, research pipelines and administrative processes. AI agents powering admissions chatbots, helpdesks and grading tools add another layer of identities and access privileges that institutions need to manage.

These identities are essential to keeping schools and universities running, but they can create significant security gaps when credentials are rarely rotated, old integration tokens remain active or automated accounts are granted more access than they need. Unlike employees and students, non-human identities are not naturally caught by onboarding and offboarding processes. Without a complete inventory, organizations can struggle to know which identities exist, who owns them and what they can access.

The report says the cybersecurity conversation in education has historically centered on protecting students, teachers and administrators, but the machine identities powering modern education technology deserve the same scrutiny, because the impact is the same whether a breach stems from a human or a machine. Back-to-school is a useful opportunity to review the full identity estate, both human and non-human, and remove identities that are no longer required.