Why Zero Trust Network Access Is No Longer Optional for EdTech Organisations

Here’s a statistic that should stop every school and university IT manager in their tracks: 91% of UK higher education institutions identified a cyber breach or attack in the past 12 months. For businesses overall, that figure is just 43%. That’s not a gap — it’s a chasm. 

Zero Trust security helps education organisations protect users, devices and data in an increasingly connected digital environment.

According to the Cyber Security Breaches Survey 2025 from the UK Government, 30% of further and higher education institutions now experience a breach on a weekly basis, and 40% of those hit report negative outcomes. 

Meanwhile, the financial toll is spiraling. The latest available data from a Sophos report shows that ransomware recovery costs for lower education nearly doubled from $1.59 million in 2023 to $3.76 million in 2024; higher education costs jumped from $1.06 million to $4.02 million. 

Schools and universities have embraced cloud platforms and remote learning at breakneck speed, yet the majority still cling to perimeter-based security models that were never built for this reality. 

Zero Trust Network Access (ZTNA) has shifted from a “nice to have” to an operational necessity. This article unpacks why the old model is broken in EdTech and lays out a practical ZTNA framework for IT teams that are already stretched thin.

The Perimeter Is Dead: Why EdTech’s Old Security Model Is Failing

The “Castle-and-Moat” Model Doesn’t Work When There’s No Castle

Traditional security operated on a “castle-and-moat” logic: everything inside the network was trusted, and the firewall was the drawbridge. That model collapses in education, where device diversity runs wild — staff BYOD, student tablets, personal phones, and guest devices all connect daily. 

As Inspiroz points out, cloud-hosted student information systems, learning management platforms, and remote staff access mean there is no single perimeter left to defend. Once an attacker steals a credential, they can roam laterally across the network with little resistance. 

The rise of remote and hybrid learning has only accelerated this fragmentation. Educational institutions face increased data breach risks amid surge in UK attacks as more schools outsource data storage to third-party providers, adding supply chain exposure to an already volatile mix. 

Consider the scale of cloud adoption: the Cloud Computing in Education Market was valued at $46.3 billion in 2024 and is projected to reach $316.7 billion by 2034, with SaaS holding over 62% of the market. When learning happens everywhere, trusting the network is a gamble no institution can afford.

Credential-Based Attacks Have Made the Old Model Obsolete

The December 2024 PowerSchool breach crystallizes this danger. A single compromised credential — used on a portal that lacked two-factor authentication — exposed data from roughly 16,000 customers and around 50 million students, making it the largest breach of minors’ data in U.S. history. 

The PowerSchool data breach: What does it mean for the educational sector? analysis confirmed that no malware or backdoor was needed; one employee’s password was enough. And phishing remains the dominant attack vector. 

The Cyber Security Breaches Survey 2025 reported that 89% of primary schools and 89% of secondary schools that experienced breaches cited phishing as the entry point. When millions of student records can be unlocked with one stolen password, perimeter trust is no longer a strategy — it’s a liability.

The Insider Threat Dimension: Students, Permissions, and the Access Problem

When Students Become Threat Actors

Insider risk in education isn’t speculation — it’s measured. An analysis by the ICO of 215 personal data breach reports caused by insider attacks in UK schools between January 2022 and August 2024 found that 57% of incidents were caused by students, and students were responsible for 97% of all attacks involving stolen login details. 

Even more sobering, 30% of school insider incidents were traced to students guessing weak passwords or finding them written down on paper. That’s not a sophisticated hacking operation — it’s opportunistic exploitation of sloppy access hygiene. 

When a year 9 student can walk into a classroom, find a Post-it note with a teacher’s credentials, and use them to access sensitive systems, the entire trust model is upside down.

Overly Permissive Access Is a Systemic Vulnerability

The same ICO analysis showed that 17% of insider incidents were caused by incorrect setup or access rights to systems such as SharePoint. 

That’s a direct symptom of overly broad permissions: staff are given access to far more than they need, and that access is rarely reviewed. This maps perfectly to the core ZTNA principle — access should be scoped to exactly what each role requires, not to the entire network. 

When a teacher’s account can reach finance systems or a student’s login can browse staff directories, the blast radius of a single compromise is massive.

What Is Zero Trust Network Access? A Practical Primer for Lean IT Teams

The Five Pillars of Zero Trust

Zero Trust is built on a simple maxim: “never trust, always verify.” No user, device, application, or network connection is automatically trusted, regardless of whether it’s inside the campus or halfway around the world. 

NIST SP 800-207 standard spells out seven tenets, including that all communication is secured irrespective of network location, access is granted per-session, and authentication is dynamic and strictly enforced before access is allowed. 

In practice, that means no standing permissions, no implicit trust, and no broad network tunnels.

What ZTNA Means in EdTech Terms

Translated to a school or university, least-privilege access means teachers can reach only instructional systems, students only learning platforms, and third-party vendors get time-bound, application-specific access — nothing more.

As Inspiroz notes, this dramatically shrinks the blast radius of any compromised account, directly addressing the PowerSchool scenario where a single credential unlocked everything. 

For a real-world example, consider that least-privilege access can be provisioned automatically via Microsoft Entra ID and HR system data, so users only see the applications they’re authorized for. 

For the percentage of FE colleges that lack dedicated cybersecurity staff — compared to 92% of higher education providers — that kind of automated access control isn’t a luxury; it’s a force multiplier.

The Framework: A Practical Zero Trust Implementation Path for Schools and Universities

Phase 1: Start with Identity and Access Controls

The CISA Zero Trust Maturity Model maps a four-stage journey — Traditional, Initial, Advanced, Optimal — across five pillars. First steps: enforce multi-factor authentication everywhere, eliminate standing broad-access credentials, and move to per-session access. 

For remote access, transitioning to a dedicated vpn for business that supports modern authentication and per-session controls can be a pragmatic step away from legacy VPNs that hand out network-level keys.

Phase 2: Integrate with Existing NAC and Endpoint Management

ZTNA works best alongside Network Access Control (NAC) to deliver per-session least-privilege access and continuous verification — especially critical in BYOD-heavy environments and remote learning scenarios. 

For many institutions, the immediate challenge is visibility. The University of Manchester, after a May 2023 breach that compromised its network, deployed Tanium’s Converged Endpoint Management platform to gain real-time visibility across nearly 40,000 endpoints. 

The University of Manchester strengthens cybersecurity after major data breach case study shows that endpoint visibility is not just about detection — it’s the foundation for enforcing access policies that adapt to device posture.

Phase 3: Layer On Continuous Verification and Audit Trails

Zero Trust access decisions are not one-and-done; they’re re-evaluated throughout each session. Continuous verification checks that the user, device, and context still meet policy before every request. 

This also creates a rich audit trail that serves dual duty: security monitoring and GDPR compliance. That compliance piece is non-negotiable. The education and childcare sector accounted for 14.44% of all reported UK data breaches in 2023, making it the second most breached sector, and 36.94% of those incidents were reported after the required 72-hour GDPR deadline. 

Detailed, tamper-proof audit logs are the difference between a defensible security posture and a regulatory nightmare.

Caveats and Counterpoints: Zero Trust Isn’t a Magic Wand

Let’s be honest about the constraints. With only the percentage of FE colleges employing dedicated cybersecurity staff, per Jisc, expecting a full-spectrum ZTNA rollout overnight is unrealistic. 

A phased approach is the only viable path. Many schools still run older student information systems, learning management platforms, or network gear that won’t easily integrate with modern ZTNA solutions — migration planning must account for that. 

Budget is another hard truth. UK educational institutions spend an average of £2 million responding to a single ransomware attack, as Jisc notes, so ZTNA investment should be weighed against the cost of inaction. Still, a primary school’s budget is not a university’s, and pricing models must reflect that. 

There’s also the user friction risk: overly restrictive access controls can frustrate teachers and students, pushing them toward shadow IT. Thoughtful policy design and user education are essential. 

And finally, Zero Trust is a journey, not a product. With 78% of UK schools having experienced at least one cyber incident, the goal is progressive risk reduction through the CISA maturity model stages, not overnight perfection.

Conclusion

The evidence is overwhelming: perimeter-based security is no longer fit for purpose in education. The attackers are targeting credentials, exploiting over-permissioned access, and moving laterally inside networks that still trust everything by default. 

Zero Trust Architecture isn’t a distant ideal — it’s a practical framework that, even in its early stages, can dramatically reduce the blast radius of a breach. For IT managers in schools and universities, the path forward starts with identity, moves to access control, and layers on continuous verification, step by step. 

The stakes are measured in student records, institutional reputation, and recovery costs that are already climbing out of control. The question isn’t whether you can afford to start the Zero Trust journey — it’s whether you can afford not to.