Action1 Finds Most Schools Underprepared for Ransomware and AI-Powered Cyberattacks Despite Rising Budgets

Report based on global survey of school IT leaders details rising threats, increased cyber budgets, and uneven adoption of critical security practices

HOUSTON, Dec. 17, 2025 /PRNewswire/ -- Action1, a leading provider of autonomous endpoint management solutions, today announced the release of its Cybersecurity in Education Report 2025-2026, revealing that cyber incidents have become the norm in schools worldwide, with most IT leaders now adopting a more realistic view of their cybersecurity readiness. Despite rising budgets, persistent staffing shortages, and structural barriers continue to leave learning environments exposed to increasingly sophisticated threats, especially AI-driven phishing and ransomware.

Now in its second year, the study surveyed more than 350 school IT leaders and administrators worldwide, tracking year-over-year changes and benchmarking cybersecurity maturity across K-12 and higher education institutions. The findings expand on Action1's 2024 research and provide a comprehensive view of how schools are responding to mounting cyber pressures as digital learning and administrative systems become more integral – and more vulnerable – than ever.

"Education systems remain a top target for cyber criminals, and while school leaders are becoming more clear-eyed about the risks, many are still stretched thin," said Mike Walters, President and Co-founder of Action1. "This year's report shows real progress in how schools approach cybersecurity, but persistent structural limitations, including staffing shortages and outdated infrastructure, continue to leave learning environments vulnerable."

Key findings from the report include:

• Growing realism about cybersecurity readiness:
  Two-thirds of school IT leaders now rate their cybersecurity maturity as moderate, while high confidence dropped from 30% last year to 18%, reflecting a clearer understanding of today's complex threat landscape.

• Cyber incidents are now the norm:
  89% of schools experienced at least one incident in the past year – primarily phishing, unauthorized access, and malware – with reported impacts including data exposure, learning disruption, and financial or reputational harm.

• Budgets are rising, but staffing gaps undermine progress:
  While more schools report stable or increasing cybersecurity spending, nearly 40% still feel underprepared for ransomware, and 74% lack a dedicated cybersecurity specialist.

• Structural barriers outweigh technical ones:
  Budget limitations, outdated infrastructure, staff shortages, and low user awareness remain the primary obstacles to stronger protection.

• Proactive practices improving unevenly:
  More schools are conducting regular vulnerability assessments, yet nearly one-third run phishing simulations only annually or not at all.

• Ransomware remains a major concern:
  Half of school IT leaders still view ransomware as a serious threat to learning continuity.

• AI-driven phishing tops emerging risks:
  A striking 92% expect AI-powered phishing to be the most dangerous threat in the coming year, surpassing ransomware.

The report highlights a sector that is maturing in its cybersecurity approach but still grappling with long-standing, structural challenges. While schools are adopting more proactive measures and gaining realism about their cyber posture, gaps in staffing, training, and resources continue to expose them to risk.

To review the Action1 Cybersecurity in Education Report 2025-2026, please visit https://www.action1.com/cybersecurity-in-education-report-2025-2026/

About Action1
Action1 is an autonomous endpoint management platform trusted by many Fortune 500 companies. Cloud-native, infinitely scalable, highly secure, and configurable in 5 minutes—it just works and is always free for the first 200 endpoints, with no functional limits. By pioneering autonomous OS and third-party patching with peer-to-peer patch distribution and real-time vulnerability assessment without needing a VPN, it eliminates routine labor, preempts ransomware and security risks, and protects the digital employee experience.

In 2025, Action1 was recognized by Inc. 5000 as the fastest-growing private software company in America. The company is founder-led by Alex Vovk and Mike Walters, American entrepreneurs who previously founded Netwrix, a multi-billion-dollar cybersecurity company.

Follow the company on LinkedIn, Reddit and X. 

SOURCE Action1 Corporation