Tom Zebedee (Cyber Essentials and Cyber Essentials Plus)
Guest: Tom Zebedee
Intro / Episode overview
Cyber security in schools is often talked about in terms of checklists and compliance. What’s less discussed is how it actually lands in real settings, with limited time, stretched teams, and competing priorities.
In this episode of EdTechStuff, I’m joined by Tom Zebedee. We have an open, practical conversation about cyber security in education, what Cyber Essentials really means for schools, and how to move beyond box-ticking towards something that genuinely reduces risk.
This episode is about realism, proportionality, and doing the right things in the right order.
What you’ll get from this episode
A plain-English view of cyber security in schools
What Cyber Essentials does and doesn’t protect you from
Common gaps schools don’t realise they still have
Why process and behaviour matter as much as tooling
Practical steps that small IT teams can actually manage
Key discussion points
Why schools remain attractive targets for cyber attacks
What Cyber Essentials is designed to achieve in education
The difference between compliance and real security
Where schools often misunderstand their own risk
Identity, access, and basic configuration issues
The importance of visibility and monitoring
Why cyber conversations need to involve leadership
Balancing security with usability in schools
Practical takeaways
If you only do one thing after listening:
Review what Cyber Essentials has actually changed in your environment, not just whether you passed.
Other actions worth considering:
Check how identity and access are really being managed
Make sure policies reflect how staff actually work
Focus on fixing basics before adding new tools
Use cyber risk to drive meaningful conversations with leaders
Treat cyber security as an ongoing process, not a yearly exercise
Who this episode is for
Network Managers and IT Technicians
Heads of IT and IT Directors
School and MAT leaders with cyber responsibility
Anyone managing Cyber Essentials in education
Schools wanting to reduce risk, not just meet requirements
About the guest
Tom Zebedee works with education organisations to improve their cyber security posture in a realistic and proportionate way. His focus is on helping schools understand risk, meet essential standards, and put practical controls in place that work in day-to-day school environments. If you want to catch up with Tom or want to learn more about his services you can find him here on LinkedIn.
Related episodes
Episode 1: Cyber security in real schools
Episode 8: Microsoft A3 vs A5 and what actually improves security
Episode 9: Cyber security in MATs and building a SOC approach on a budget
Have a question or want to suggest a topic?
If cyber security is something you’re grappling with right now, get in touch.
Future episodes of EdTechStuff are shaped by real problems from real schools, not abstract frameworks.