Education is now one of the most targeted sectors in the UK
Schools and trusts hold some of the most sensitive data anywhere pupil records, safeguarding notes, EHCPs, medical and social-care information often with the smallest IT teams and tightest budgets. That combination makes education a prime target. The UK Government’s Cyber Security Breaches Survey found that the majority of secondary schools, and a large share of primaries, reported a cyber incident in the past year, with phishing and ransomware the most common threats.
When an incident hits a school, it isn’t just an IT problem. It disrupts teaching, exposes children’s data, and lands on the desk of leaders and governors who are now accountable for it. The DfE has been clear: Cyber Security is a leadership responsibility, not something IT can carry alone.
Built to help you meet the DfE cyber security standard
The DfE’s cyber security standard sits within the wider digital and technology standards that schools and trusts should be working towards by 2030 and which the Academy Trust Handbook 2025 expects trusts to be actively progressing. We map our service directly to what the standard asks of you.
A note on Cyber Essentials: the DfE recommends schools check that their IT support provider holds Cyber Essentials, and it is a funding-agreement requirement for colleges. We help you achieve Cyber Essentials and Cyber Essentials Plus — and we hold it ourselves.
Three levels of cover, priced for education
Start where your setting is today and step up as you grow. Single schools, special and AP settings, and multi-academy trusts are all welcome we scale the same approach across one site or many.
Secure Foundation
The essentials every school should have in place.
Managed Detection & Response
Active monitoring and response — eyes on your environment around the clock. Everything in Secure Foundation, plus:
Security Partner (vCISO)
Strategy, governance and compliance — for trusts and larger settings. Everything in MDR, plus:
A defined process that respects the school calendar
Security work shouldn’t disrupt teaching. We follow a structured onboarding and plan changes around your term dates and INSET days, so the rollout is smooth and predictable.
Discovery & baseline
Secure delegated access (least privilege), a baseline of your Microsoft Secure Score, and a gap assessment against the DfE cyber standard and Cyber Essentials.
Prioritised plan
A clear remediation plan you and your leadership team sign off before anything changes.
Deploy & harden
MFA, conditional access, device baselines, endpoint and email protection, and managed patching — scheduled around the school day and holidays.
Monitor & validate
(MDR and above) Monitoring connected, detections tuned, and a live test alert run end to end to prove escalation works.
Report & review
A clear monthly security report, a 30-day review, and termly reviews aligned to governance cycles — ready to share with your board or governors.
“No outsourced helpdesk. No generic packages. A direct line to specialists who understand both the Microsoft environment and the realities of running a school.“
We come from your sector
Bitnet didn’t arrive in education to sell cyber security. We’ve spent years building technology for special schools, alternative provision and SEND settings the parts of the system that handle the most sensitive pupil data, often with the least support. That’s our starting point, and it shapes how we approach security: proportionate, practical, and built around safeguarding-grade data, not generic corporate IT.
We pair that sector understanding with Microsoft’s security platform Defender, Entra ID, Intune, Sentinel and Purview the most widely deployed enterprise security stack in the world. The tools are powerful but assume in-house expertise most schools don’t have. We provide that expertise, so your team doesn’t have to.
Our security service works alongside your existing filtering and monitoring and your safeguarding responsibilities under Keeping Children Safe in Education protecting the systems and data that sit behind them.
What it means for your school or trust
DfE-aligned and audit-ready
Clear evidence of progress against the cyber security standard for leadership, governors and inspectors.
Pupil and staff data protected
Multi-layered defence across devices, email and identities, supporting your UK GDPR obligations.
Less disruption to learning
Proactive monitoring and fast response mean fewer incidents and quicker recovery.
Budget that goes further
Enterprise-grade protection priced for education, consolidating tools you may be paying for separately.
Leadership peace of mind
A named team, plain-English reporting, and security leadership you can put in front of your board.
Questions from schools & trusts
No — it’s designed for exactly that situation. The DfE expects every setting, regardless of size, to work towards the cyber security standard, and smaller schools are often the most targeted. We do the heavy lifting so your team (or your one IT person) isn’t carrying it alone.
Yes. We scale the same approach across multiple settings, with centralised management and trust-wide reporting, while still tailoring controls to each school. Our Security Partner (vCISO) tier is built for trust-level governance and board reporting.
We map our service directly to the cyber security standard — risk assessments, MFA, patching, asset registers, backup, incident reporting and staff training — and give you the evidence to show progress towards the 2030 expectations. We can also support the wider compliance picture alongside your other providers.
Yes. We come from the special and AP sector, so safeguarding-grade data is our normal context. We work under a Data Processing Agreement, apply least-privilege access, and use Microsoft Purview to help protect and govern sensitive information in line with UK GDPR.
We plan deployment around your term dates, INSET days and the school day, and nothing changes in your environment without leadership sign-off. The goal is protection with minimal disruption.
Absolutely. Clear, board-ready reporting is built into our service — including the cyber training expectation that at least one governor or trustee should complete.