1 October 2026
David Batho, director of sector security for Jisc, the UK’s digital, data and technology agency focused on tertiary education, research and innovation, warned leaders in the sector that they face sustained cyber pressure. While ransomware and phishing remain the leading concerns in Jisc’s cyber posture survey, the nature of cyber extortion is changing, supply chains are a source of vulnerability, and the sector’s security capacity is uneven.
In the first quarter of 2026 Jisc reported eight ransomware attacks on member institutions and found over 144,000 username and password combinations relating to members on the dark web. Batho warned that stolen data credentials or other data can be leveraged to extort organisations as criminal groups emerge supplying “ransomware as a service”. He emphasised that research data is particularly valuable as a source of intellectual property and the risk to research institutions’ reputations and partnerships in the event of theft.
Batho urged leaders to investigate the security of third-party service suppliers following high-profile incidents in the automotive and retail industries. He emphasised the importance of knowing exactly who can access systems, how quickly suppliers can notify them of incidents, and how to source data and logs. He recommended that incident recovery tests should be conducted together with suppliers.
Actions that senior leaders themselves can take immediately include assuring internal governance and security responsibilities. Updates to the Cyber Essentials standards, the National Cyber Security Centre’s Cyber Assessment Framework, and the upcoming Cyber Security Resilience Bill place further responsibilities on charities and public bodies to implement and evidence cyber security controls. Batho acknowledged the challenge many further education colleges face in funding dedicated cyber security staff.
Jisc members benefit from a baseline of security provided by the Janet education and research network including DDoS mitigation, Protective DNS and incident support. Batho urged leaders to engage with other Jisc cyber security services to build confidence through training and exercises, set priorities through a cyber security assessment, and strengthen operations by joining the Security Operations Centre.