Text message
From: +44 7700 900123
Parcelo: we tried to deliver your parcel today. Pay the £1.45 redelivery fee within 12 hours or it will be sent back.
parcelo-redeliver.example/pay
Resources for teachers
Cyber in the classroom: a teacher's guide
Everything a teacher needs to bring cyber security to life: games you can run tomorrow, interactive diagrams that explain how attacks really unfold, a translator for the jargon, the honest careers evidence, and the law you should know before anyone gets curious. Free, sourced line by line, and written by people who would genuinely like your students to enjoy it.
For teachers. Every figure is sourced and was checked on 1 November 2026. Every message, name and address in these activities is made up. Web addresses in the examples end in .example, a reserved ending that can never be a real website, and nothing in the interactive activities collects or stores anything a student types.
Start here
Ask your class to draw a hacker
Before you say a single word about cyber security, hand out paper and ask everyone to draw a hacker, and then compare notes. You already know what you will get: a hoodie, a dark room, green letters raining down a screen and possibly a mask, none of which has much to do with what the work actually looks like, which is at least as likely to involve a policy, a spreadsheet and a long meeting about why a supplier's invoice looks slightly off.
That gap between the picture in our heads and the reality is the whole opportunity. Cyber security is full of jobs that never make it into a film, and the latest labour market report shows how different the real mix is, with governance and risk management employing people in far more cyber businesses than security testing does. Once students see that, the subject stops being a thing for a particular type of person and becomes a thing for a lot of types of person, which is a much better place to teach it from.
Why it matters
The honest case for teaching it
We could just say there is a huge skills shortage and leave it there, and plenty of people do. But you are the one standing in front of fifteen year olds who will check, so here is what the evidence really says, including the awkward bits.
The need is genuine. Businesses lack basic cyber skills, the sector has to find thousands of new people every year, and it is a real industry worth billions with thousands of firms. But the entry door is narrower than the headlines suggest: employers mostly ask for experience and for a degree, and the share of roles open to beginners has fallen. What the numbers do not say is that cyber is closed. A good proportion of firms have hired through routes that are not degrees, and people arrive from many subjects. So the message for your students is not 'this is easy' and it is not 'this is impossible', it is that real, demonstrable skill gets noticed, and you can start building it years before anyone asks for a CV.
Closer to home
Your school is in the figures too
This is the part that makes a class sit up. The government's annual survey asks organisations whether they have had a cyber breach or attack, and it includes schools, colleges and universities. A good lesson hook is that the thing you are about to teach is not abstract: it is happening to institutions very like this one. Treat the numbers as indicative, because the samples are small and only count what organisations noticed themselves, but the pattern is clear and so is the most common type of attack.
The activities
Run these in your classroom
Everything below works in a normal lesson. Most of it needs one projector. Two activities can be run with no devices at all: the starter, and the cipher workshop, which works with pencil and paper. Timings are our suggestions from how long each takes to run, so adjust them to your group, and every activity has teacher notes, answers and discussion questions in the downloadable pack.
Works with no devices
Draw a hacker
A five minute starter that shows a class what they already believe, before you show them what the industry actually looks like.
5 to 10 minutes
Needs a screen
Spot the phish
Eight made-up messages, two of them genuine. Can your class tell which? Built on the NCSC's five signs of a scam.
20 to 30 minutes
Needs a screen
Password maths lab
Change one thing and watch the number of possibilities explode. Why length beats cleverness, shown with real arithmetic.
15 to 20 minutes
Works with no devices
Cipher workshop
Send a secret message with the oldest trick in the book, then break it by counting letters. Then see why nobody uses it any more.
30 to 40 minutes
Needs a screen
An attack, step by step
An interactive diagram that walks through how an attack unfolds, what defenders can do at each stage, and which job does it.
15 to 25 minutes
Needs a screen
Where hard hats meet hackers
An interactive map of the physical world cyber has to protect, and the hands-on careers, including drone work, that keep it running.
10 to 20 minutes
Needs a screen
Play it legally
A lunchtime or club session built on the legal places to practise, with the law explained first so nobody gets caught out.
A club session
Download the teacher pack. Timings, step-by-step instructions, discussion questions, answers and sources for every activity, as a PDF or an editable Word file you can adapt.
Starter: draw a hacker
Draw a hacker
A five minute starter that shows a class what they already believe, before you show them what the industry actually looks like.
5 to 10 minutesPaper and pens. No devices.
How to run it, questions to ask, and what to watch for
Running it
- Give each student a sheet of paper and two minutes to draw a hacker. No talking and no looking at each other's.
- Put the drawings up, or hold them up, and ask what the same things are.
- Then open the attack diagram and the hard hat map and ask what is missing from the drawings.
Questions to ask
- Where does our picture of a hacker come from?
- Which jobs in the attack diagram would never appear in a film?
- Who in this room could do one of them?
Watch for
- Some students will draw an attacker and others a defender. Ask which they drew, because it is a good way into red team and blue team.
Students will be able to: describe how cyber security people are shown in films and games. name at least three kinds of cyber job that look nothing like that picture.
Game: spot the phish
Spot the phish
Eight made-up messages, two of them genuine. Can your class tell which? Built on the NCSC's five signs of a scam.
20 to 30 minutesA projector for the whole class, or one device per pair.
The five signs of a scam, from the NCSC
- Authority: It claims to come from someone official or important, like a bank, a courier, a teacher or the government.
- Urgency: It sets a deadline or threatens a consequence so you act before you think.
- Emotion: It tries to make you panic, hope, worry or feel curious.
- Scarcity: It offers something in short supply, so you feel you might miss out.
- Current events: It uses the news or the time of year, like results season or tax deadlines, to seem relevant.
What do they mean?
- Authority
- It claims to come from someone official or important, like a bank, a courier, a teacher or the government.
- Urgency
- It sets a deadline or threatens a consequence so you act before you think.
- Emotion
- It tries to make you panic, hope, worry or feel curious.
- Scarcity
- It offers something in short supply, so you feel you might miss out.
- Current events
- It uses the news or the time of year, like results season or tax deadlines, to seem relevant.
Message 1 of 8Not answered yet
How to run it, questions to ask, and what to watch for
Running it
- Project the page. Read message 1 aloud and give the class 30 seconds to vote with hands up: scam or genuine.
- Press the answer, then ask which of the five signs they noticed before you read the clues.
- Repeat for all eight. After the last one, point out that two were genuine and ask what made them safe.
- Finish with how to report: texts to 7726, emails to the NCSC, and who to tell in your own school.
Questions to ask
- Which message would have fooled you, and why?
- A genuine message can have a deadline. What else did the sign-in code email do to show it was safe?
- Why do scammers try to make us feel panic or excitement?
Watch for
- Students who decide everything is a scam. The aim is knowing what to check, not trusting nothing.
- The headteacher gift voucher message may be recognised from real life. That is useful, and a good moment to remind everyone how to report.
Students will be able to: name the five tell-tale signs of a scam message. explain why a genuine message can still have a deadline. say what to do, and who to report to, when one arrives.
Lab: password maths
Password maths lab
Change one thing and watch the number of possibilities explode. Why length beats cleverness, shown with real arithmetic.
15 to 20 minutesA projector or one device per pair.
Powerful equipment trying weakly protected passwords. These speeds are illustrations, not measurements: the real figure depends on how a service stores passwords and on what equipment the attacker has. The lesson is how fast the answer grows when one thing changes, not any single number.
Side by side, at the speed you picked
| Password | Possible passwords | Bits | Average time to find |
|---|---|---|---|
| 8 random characters, every type | about 6.1 quadrillion | 52 | 8 hours |
| 12 random lower case letters | about 95.4 quadrillion | 56 | 6 days |
| 3 random words (7,776 word list) | about 470 billion | 39 | 2 seconds |
| 4 random words (7,776 word list) | about 3.66 quadrillion | 52 | 5 hours |
| 6 random lower case letters | about 309 million | 28 | instantly |
- Every extra character or word multiplies the possibilities, it does not just add to them. That is why length does so much of the work.
- The NCSC recommends three random words. The word random matters: avoid dates, sports teams, and the names of family and pets, because that kind of detail is often easy to find online.
- The NCSC also says swapping letters for numbers, like an o for a zero, does not meaningfully strengthen a password, because attackers know the swaps.
- The sums here assume a truly random choice and a service that stores passwords sensibly, so they flatter the person choosing. A password someone thought of themselves can be much easier to guess than the sums suggest.
How to run it, questions to ask, and what to watch for
Running it
- Start with the random characters panel at 8 characters with every type ticked, at the fastest speed. Ask students to guess how long it will last.
- Move the length slider by one and ask what happens to the number. Establish that each extra character multiplies it.
- Switch to random words. Compare 3 words with 8 mixed characters in the side by side table.
- Ask why the NCSC suggests words rather than symbols, and which is easier to remember at the same strength.
Questions to ask
- Why does one extra character make such a difference?
- What is wrong with using your pet's name, even if you add a number?
- Where would a password manager help?
Watch for
- The figures flatter whoever chose the password, because real choices are less random. Make sure students leave with long and random, not with one particular number.
Students will be able to: explain how the number of possible passwords grows with length. say why three random words works and why swapping letters for numbers does not.
Workshop: crack the cipher
Cipher workshop
Send a secret message with the oldest trick in the book, then break it by counting letters. Then see why nobody uses it any more.
30 to 40 minutesA device per pair, or paper cipher wheels. Pencil and paper also works.
1. Send a secret message
What you would send
Phhw ph dw wkh oleudub dw qrrq
To read it, your friend shifts every letter back by the same number. That shared number is the key.
2. Break one without the key
Count the letters
The tallest bar is L. In English the most common letter is E, so this is probably an E in disguise, which means the key is probably 7.
Or just try every key
A Caesar cipher only has 25 useful keys, so a computer, or a patient person, can simply try them all in less than a second. That is the real reason nobody uses it for anything that matters.
How modern encryption is different
Modern encryption such as AES with a 128-bit key has 2 to the power 128 possible keys, which is about 3.4 x 10^38 (34 followed by 37 zeros), against 25 for a Caesar cipher. Trying them all is not just slow, it is out of the question, which is why so much of cyber security is about the practical and human side: people, passwords and software updates.
How to run it, questions to ask, and what to watch for
Running it
- Pair students. Each writes a short message and encrypts it with a shift only they know, using the first panel or a paper cipher wheel.
- Swap messages and try to read each other's using the letter count in the second panel.
- Show the list of all 25 readings and ask how long a computer would take.
- Finish with the modern encryption box: why 25 keys is nothing and 2 to the power 128 is out of reach.
Questions to ask
- Why did counting letters work so well on the long message and so badly on a short one?
- If an attacker can try every key, what makes a cipher strong?
- Where do you rely on encryption without noticing?
Watch for
- Ciphers are not named in the DfE content we read, so present this as enrichment, and check how your exam board's specification covers encryption.
Students will be able to: encrypt and decrypt with a Caesar cipher. break one using frequency analysis. explain why a key that can only be one of 25 values is not secure.
Diagram: an attack, step by step
An attack, step by step
An interactive diagram that walks through how an attack unfolds, what defenders can do at each stage, and which job does it.
15 to 25 minutesA projector. Best as a whole class discussion.
The example follows Marlow & Finch, a made-up accountancy practice with 40 staff. Choose a stage, or step through them in order.
Stage 1: Find out about the target
Before anything happens to a computer, an attacker gathers information to plan, and sets up what they will need. Often this means reading what people have put online.
In MITRE ATT&CK this covers: Reconnaissance, Resource Development
What the attacker does
The attacker reads the Marlow & Finch website and staff social media, learns who runs the finance team and which software they use, and sets up an email address that looks almost like the managing director's.
Ways to make it harder
- Be thoughtful about what is public about staff and systems.
- Teach everyone that information about them can be used against them.
- Watch for look-alike addresses and websites.
Jobs that work here
- Threat Intel
- Penetration Tester
Roles from the Cyber family of the TechSkills Career Matrix.
Ask the class: What could a stranger work out about our school from its website and our social media?
Stage 2: Get in
The attacker finds a way in. Very often this is a person tricked into helping, or a weakness that was never fixed.
In MITRE ATT&CK this covers: Initial Access
What the attacker does
A member of the finance team gets an email that appears to come from the managing director asking for an urgent invoice to be paid, and clicks the link.
Ways to make it harder
- Train people to spot and report scam messages.
- Use two-step verification so a stolen password is not enough.
- Install software updates promptly.
Jobs that work here
- SOC Analyst
- Vulnerability Analyst
Roles from the Cyber family of the TechSkills Career Matrix.
Ask the class: Which of the five signs from Spot the phish was this email using?
Stage 3: Get settled
Once in, the attacker runs their own code, makes sure they can get back in, tries to gain more power on the system, and tries to avoid being noticed or to switch off the alarms.
In MITRE ATT&CK this covers: Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment
What the attacker does
Hidden software installs itself on the finance computer, creates a second way in, and quietly turns off the usual warnings.
Ways to make it harder
- Give people only the access they need for their job.
- Keep security tools running and protected from being switched off.
- Keep a record of what happens on systems, so odd behaviour can be spotted.
Jobs that work here
- Security Engineer
- Malware Analyst
Roles from the Cyber family of the TechSkills Career Matrix.
Ask the class: Why is it a problem if every member of staff can change every setting?
Stage 4: Look around and spread
The attacker steals more logins, explores the network to learn what is where, and moves from computer to computer towards what they want.
In MITRE ATT&CK this covers: Credential Access, Discovery, Lateral Movement
What the attacker does
From the finance computer, the attacker finds saved passwords, discovers the file server holding client records, and logs into it.
Ways to make it harder
- Separate systems so one problem cannot reach everything.
- Use different strong passwords for different things.
- Monitor for unusual logins, like a finance login at 3am.
Jobs that work here
- SOC Analyst
- Security Architect
Roles from the Cyber family of the TechSkills Career Matrix.
Ask the class: How is this like a visitor who gets into a school building and then tries every door?
Stage 5: Take what they came for
The attacker gathers the data or access they want, keeps in touch with the compromised systems, and sends the stolen information out.
In MITRE ATT&CK this covers: Collection, Command and Control, Exfiltration
What the attacker does
Client records are copied into a single hidden file and sent out of the firm over several nights.
Ways to make it harder
- Watch for large or unusual amounts of data leaving.
- Protect the most sensitive data with extra controls.
- Keep clear records of what data is held, so a loss can be understood quickly.
Jobs that work here
- Incident Responder
- GRC Analyst
Roles from the Cyber family of the TechSkills Career Matrix.
Ask the class: Why might an attacker want to move data out slowly instead of all at once?
Stage 6: Cause the damage
The attacker disrupts, destroys, locks or manipulates systems or data, or demands money. This is the stage most people notice.
In MITRE ATT&CK this covers: Impact
What the attacker does
The firm's files are locked and a message demands payment. Staff cannot work and clients cannot be reached.
Ways to make it harder
- Keep backups that are separate from the main systems and test that they work.
- Have a written plan for what to do, and practise it.
- Know who to tell, inside and outside the organisation.
Jobs that work here
- Incident Response Lead
- Digital Forensics Analyst
Roles from the Cyber family of the TechSkills Career Matrix.
Ask the class: What would our school need in place to carry on teaching if its systems stopped working tomorrow?
Real attacks do not always follow these stages in order, skip some, and repeat others. This is a deliberate simplification of the tactics in MITRE ATT&CK (version 20), to give a class a shape to talk about.
How to run it, questions to ask, and what to watch for
Running it
- Project the diagram at stage 1. Read the plain description and the example, then ask the class what a defender could do.
- Reveal the ways to make it harder and compare them with the class's ideas. Use the Ask the class question at each stage.
- At every stage, point to the jobs that work there, and ask which stage a student would like to work on.
Questions to ask
- Which stage is easiest to stop, and which is hardest?
- If a defender could stop only one stage, which would you pick?
- Where do people, rather than computers, matter most?
Watch for
- Real attacks do not always follow the order, skip stages and repeat others. Say so when a student points it out, because they are right.
Students will be able to: describe the stages of an attack in order. suggest a defence for each stage. match a cyber job to the stage it works on.
The gamer question
Gamers and cyber: what we know, and what we do not
Everyone says gamers make brilliant cyber professionals, and it is a lovely story, so we went looking for the evidence. We did not find a published study that measures whether gaming experience predicts how well someone does in a cyber job, so we are not going to tell you it does. We would rather give you a claim that survives a sceptical student, and there is a more practical truth underneath it.
Capture the flag competitions and cyber practice platforms are games in their own right, with puzzles and scoreboards. If you have gamers in your class, and you almost certainly do, the useful thing you can do is point their energy at places where it is legal, and tell them why that matters. The National Crime Agency lists several, and it is blunt about the risks: knocking an opponent offline with a booter in a game is, in its own example, an offence.
So the line we would give a gamer is this: the instincts you already have are worth something, there are real, legal, free places to use them, and the same skill used on someone else's system without permission can lead to a criminal record and damage your education and career, which is the NCA's own list of consequences. Both halves of that sentence are true and both are worth hearing.
Hard hats, drones and the physical world
Cyber is not only for people who like screens
Here is something that surprises almost every student, and quite a few teachers: some genuine technology careers involve a hard hat and steel toecaps. Our Career Matrix has a name for the genuinely physical, on-site routes, Hard Hat Tech: fibre engineering, data centres, industrial automation, smart buildings, utilities and surveying with drones. Five of our eight career families have one.
And cyber itself has one. Operational Technology security is about protecting the control systems of physical equipment, such as pumps, power switches and factory machines, and its roles, OT Security Engineer and ICS Security Analyst among them, are listed in the Matrix as a genuinely hands-on route. Equipment like that is controlled by digital systems, which is why it is also a cyber question, and why the hard hat world is worth a look for a student who likes both the practical and the digital.
Drones are the perfect doorway, because students already find them thrilling. They turn up on the hands-on side, with surveyors piloting mapping drones, and on the cyber side, where the Matrix gives the example of securing a fleet of autonomous drones from signal hijacking. If your school wants a drone club, the rules changed on 1 January 2026, and the box below says exactly how.
Where hard hats meet hackers
An interactive map of the physical world cyber has to protect, and the hands-on careers, including drone work, that keep it running.
10 to 20 minutesA projector or a device per pair.
9 hands-on routes in the Career Matrix, across 5 of our 8 career families. Pick one to see what the job looks after, who does it, and why it is a cyber question too.
Data & AI, area 01: Data Foundations & Engineering
Construction Technology & Geospatial Surveying
Capturing the data that describes the physical world, on site rather than in an office.
Before any dataset, 3D model or map exists, someone has to capture the real world accurately: laser-scanning a construction site, surveying land with GPS equipment, or flying a mapping drone. This is data engineering's on-site, hands-on entry point.
Jobs on this route
- Surveying Technician
- Engineering Design Technician (BIM/CAD)
- Geospatial Survey Technician
Pay, with its source
£32,905 to £47,519 (median, surveying technician to chartered surveyor)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
Drones and survey equipment collect data and are controlled over wireless links. The Career Matrix gives securing a fleet of autonomous drones from signal hijacking as an example of what a cyber professional contributes.
Data & AI, area 09: Asset Integrity & Inspection Engineering
Non-Destructive Testing (NDT)
Hands-on inspection of real components and structures, through a paid apprenticeship rather than an engineering degree.
Inspect materials, welds and components on site or in a test facility using ultrasonic, radiographic and other non-destructive methods, working towards industry-recognised NDT certification rather than starting with a standalone degree.
Jobs on this route
- NDT Operator Apprentice
- NDT Engineering Technician
- Inspection Engineer
Pay, with its source
£22,000 to £45,000+ (Level 2 operator apprentice to Level 3 engineering technician, Glassdoor/Indeed UK benchmarks)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
Inspection records on assets like pipelines and structures are only useful if they are accurate and have not been altered.
Cyber Security, area 03: Engineering & Architecture
Operational Technology (OT) Security
Protecting the industrial control systems that run power stations, water plants and factories, not just office networks.
Secures the operational technology behind critical national infrastructure: the industrial control and SCADA systems that run water treatment, power generation and manufacturing. Involves visiting live sites to assess and harden real plant equipment alongside the engineers who run it, not just monitoring a screen from a desk.
Jobs on this route
- OT Security Engineer
- ICS Security Analyst
- Industrial Cyber Security Consultant
Pay, with its source
£36,000 to £100,000+ (range across real UK OT security job postings, analyst to consultant level)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
This is the cyber job on the hard hat side of the line: protecting the control systems themselves, working with the engineers who run the equipment.
Cloud & Infrastructure, area 04: Data Centre Ops
Data Centre Operations
Keeping the internet physically running: servers, cooling, backup power and cabling.
Install, service and maintain the physical infrastructure behind every cloud platform: server hardware, cooling systems, backup power and structured cabling. The site-based, hands-on side of "the cloud".
Jobs on this route
- Data Centre Support Technician
- Electrical Service & Maintenance Technician
- Information Communications Technician
Pay, with its source
£34,073 to £41,111 (median, equipment installer to electrical maintenance technician)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
Data centres hold the servers online services run on, so who can walk in and what can be logged in to have to be thought about together.
Networks & Connectivity, area 03: Digital Infrastructure (Fibre)
Telecoms & Fibre Field Engineering
Building and maintaining the UK's physical fibre and mobile network, on-site rather than at a desk.
Install, splice, test and maintain the fibre-optic and cellular infrastructure that carries the UK's broadband and mobile traffic, from splicing cabinets on a street corner to commissioning a 5G mast.
Jobs on this route
- Network Cable Installer
- Telecoms Field Operative
- Fibre Jointer
- Cellular Network Field Engineer
Pay, with its source
£23,000 to £60,000 (ITP range for Cellular Network Field Engineer; ONS ASHE median £39,652 for the wider occupation)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
This is the physical network everything else runs on. Keeping it working is a cyber question as well as an engineering one.
Networks & Connectivity, area 04: IoT & Wireless Tech
Smart Buildings
Installing and commissioning the connected systems that make a building intelligent.
Buildings are becoming connected, automated and energy-managed. Install and commission the fire, security and building energy management systems that keep them safe and efficient: hands-on work in plant rooms and on site, not behind a desk.
Jobs on this route
- Fire & Security Systems Technician
- BEMS Controls Engineer
- Building Automation Installer
Pay, with its source
£37,991+ (median, Security System Installers and Repairers)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
Building controls, alarms and door systems are connected to networks, which makes them part of the cyber picture.
Emerging Technologies, area 02: Robotics & Automation
Industrial Automation
Keeping factories and production lines running: PLCs, robots, sensors, conveyors.
Install, maintain and fault-find the automated production lines, industrial robots and control systems that keep factories, warehouses and increasingly farms running. Hands-on shift or site based work, not a design office.
Jobs on this route
- Automation & Controls Engineering Technician
- Mechatronics Maintenance Technician
- Aircraft Maintenance Technician
Pay, with its source
£40,002+ (median, Automation Maintenance Technicians)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
Machines on a factory floor are run by digital control systems, which is exactly what Operational Technology security protects.
Emerging Technologies, area 07: Climate & Green Technology Engineering
Utilities Technology
Modernising the UK's energy, water and metering networks, on-site and in the field.
Build, maintain and upgrade the power, water and smart-metering networks the net-zero transition depends on, and manufacture the batteries that store the energy it runs on: substations, water networks, smart meters and battery production lines.
Jobs on this route
- Water Industry Network Technician
- Dual Fuel Smart Meter Installer
- Overhead Linesperson / Substation Fitter
- Battery Manufacturing Technician
Pay, with its source
£39,057 to £48,171 (median, water network operative to electrical trades)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
Smart meters, pumps and substations are run by digital control systems, so they are part of the cyber picture.
Emerging Technologies, area 09: Manufacturing & Production Engineering
Manufacturing & Production Engineering
Hands-on entry into keeping factories and production lines running, through a paid apprenticeship rather than an engineering degree.
Work on a real factory floor or process plant from day one: gathering production data, solving quality and reliability problems, and keeping high-hazard, continuous processes running to specification, under supervision and structured off-the-job training rather than a standalone engineering degree.
Jobs on this route
- Engineering Manufacturing Technician Apprentice
- Process Industry Technician Apprentice
- Production Support Technician
Pay, with its source
£24,000 to £55,000+ (technician apprentice to experienced production/process technician)
Figures last checked from 11 July 2026. The career guides show each source in full.
Why it is a cyber question too
Production equipment is run by digital control systems, so it is part of the cyber picture too.
Starting a drone club? The rules changed on 1 January 2026
From 1 January 2026 anyone flying a drone that weighs over 100g needs a Flyer ID, which comes from a free theory test on the CAA website (the old threshold was 250g).
Under-18s need a Flyer ID and can take the test themselves, but a parent or guardian must hold the Operator ID. Children under 13 need a parent or guardian with them for the online test, and children under 12 must be supervised by someone aged 16 or over when flying.
Source: Civil Aviation Authority, 29 December 2025. This is the Flyer ID rule. If a drone is used for paid or commercial work, check with the CAA what else applies.
How to run it, questions to ask, and what to watch for
Running it
- Ask the class to name a job that involves a hard hat and a computer. Collect the answers.
- Open the map and look at three routes together: read the jobs, then why it is a cyber question too.
- If you have a drone club, or want one, read the CAA box together.
Questions to ask
- Which of these jobs did you not know existed?
- Why would a power switch or a drone need cyber security?
- Which would you try?
Watch for
- Pay figures are medians or ranges from different sources, so always read the source line and the date.
Students will be able to: name three hands-on technology careers and what each looks after. explain why a power switch or a drone is also a cyber question.
Before anyone gets curious
The law, in plain English, and how to play legally
A cyber lesson will, sooner or later, produce a student who asks whether they could try it on something real. It is far better to have answered that before it is asked. The Computer Misuse Act 1990 is the law that matters, and the National Crime Agency explains it clearly for young people, parents and teachers, and names all three as audiences.
The practical rules for your classroom are short. Only practise on systems built to be practised on, or ones you have clear, written permission to test. Never let students point tools at the school network, a website or another person's account, however friendly the intention. Use the activities here and the legal platforms the NCA lists. And if you ever worry about a student, the NCA's Cyber Choices programme is aimed at helping young people make better choices, and it names teachers as one of its audiences.
This is general information to help you teach, not legal advice, and the NCA's page is the place to read the detail.
Play it legally
A lunchtime or club session built on the legal places to practise, with the law explained first so nobody gets caught out.
A club sessionDevices with internet access, and a teacher who has read the law section.
How to run it, questions to ask, and what to watch for
Running it
- Read the law section aloud first, so nobody can say they were not told.
- Choose one legal platform from the NCA's list that suits the group's age, and try it yourself before the session.
- Make the rule clear: only on systems built for practice, never the school network or anyone else's accounts.
Questions to ask
- What is the difference between a capture the flag game and breaking into a real website?
- Why does permission matter?
- Who could you talk to if you were unsure?
Watch for
- Check each platform's own age rules and terms before using it with a class.
Students will be able to: explain what the Computer Misuse Act 1990 means for them. name at least three legal places to practise.
For teachers
The Translator
Cyber is full of jargon, and nobody wants to bluff their way through it in front of a class. Search any term below for what it means in plain English, a comparison from school life you can use straight away, where that comparison stops working, and what it looks like in a real job.
22 terms
Botnet
- In plain English
- A network of infected devices controlled by an attacker, often without their owners knowing, used to send spam or carry out denial of service attacks.
- Think of it like this
- Thousands of classroom clocks secretly set to chime on the same signal, from one hidden remote.
- At work
- Understanding botnets is part of both threat intelligence and incident response.
Capture the flag
Also called: CTF
- In plain English
- A cyber competition where teams solve puzzles and challenges, on systems built for the purpose, to find hidden 'flags' that score points.
- Think of it like this
- A very nerdy treasure hunt, with a leaderboard.
- At work
- They are legal because the targets are built to be practised on, which is why the NCA lists platforms like these as legal places to practise.
Denial of service
Also called: DoS, DDoS, booter, stresser
- In plain English
- Flooding a website, game server or network with so much traffic that real users cannot get through. 'Booter' or 'stresser' tools sell this as a service.
- Think of it like this
- Everyone in the school blocking one doorway at the same time so nobody can get to lessons.Where that stops working: Using a booter, even on a gaming opponent, is an offence under the Computer Misuse Act. The NCA uses this exact example.
- At work
- Defenders plan for it and have ways to absorb or filter the flood.
Digital forensics
- In plain English
- Finding, preserving and examining digital evidence, for example to work out how an attack happened or to support an investigation.
- Think of it like this
- Working out who left the tap running by looking carefully at what was left behind, without touching anything that might spoil it.
- At work
- It is the least common specialism among UK cyber security businesses in the latest labour market report, at 10%.
Encryption
- In plain English
- Scrambling information with a key so only someone with the right key can read it.
- Think of it like this
- A note written in a code that only you and your friend know how to read.Where that stops working: Real encryption is far stronger than a pass-a-note code. Try the Cipher Workshop to see why the simple ones fail.
- At work
- It protects everything from online banking to messages, and is the work of cryptographers and engineers who use it well.
Firewall
- In plain English
- A control that decides which network traffic is allowed in and out of a device or network.
- Think of it like this
- The front office: everyone coming in is checked against a list, and some people are simply not let past.Where that stops working: A firewall does not stop someone you have already let in, or a user who clicks a bad link.
- At work
- It is one of the most basic protections an organisation puts in place.
Governance, risk and compliance
Also called: GRC, cyber governance
- In plain English
- The side of cyber about decisions, rules and evidence: deciding what risks matter, writing policies, checking they are followed and proving it.
- Think of it like this
- Safeguarding policy and the checks, records and training that show it is real, not just a document in a drawer.
- At work
- Governance and risk management is the most common specialism among UK cyber security businesses, ahead of security testing.
Incident response
- In plain English
- What an organisation does when something has gone wrong: working out what happened, stopping it spreading, fixing it and learning from it.
- Think of it like this
- The plan for a fire: raise the alarm, get everyone out, find the cause, and change something so it does not happen again.
- At work
- It involves communication and planning as well as technical work.
Malware
Also called: virus, trojan, spyware
- In plain English
- Software designed to cause harm: to steal information, spy on you, lock your files or give someone else control of your device.
- Think of it like this
- A game that says it is free but quietly copies your contacts while you play.Where that stops working: Not all malware announces itself. Much of it is built to stay quiet.
- At work
- Some analysts specialise in taking suspicious files apart in a sealed-off environment to find out what they do.
Operational technology
Also called: OT, industrial control systems, ICS
- In plain English
- The technology that controls physical equipment: pumps, power switches, factory machines, building systems. Securing it is its own specialism.
- Think of it like this
- The boiler controls and the fire alarm panel, as opposed to the school's admin computers.Where that stops working: OT often runs for many years, so it can be harder to update than ordinary IT.
- At work
- Our Career Matrix counts OT security as a genuinely physical, on-site route, with roles like OT Security Engineer and ICS Security Analyst.
Password manager
- In plain English
- An app that creates strong, different passwords for every account and remembers them for you.
- Think of it like this
- A very trustworthy friend with a perfect memory and a locked diary.Where that stops working: You still need one strong password to protect the manager itself. The NCSC suggests a password manager as an alternative to remembering lots of passwords.
- At work
- Some organisations provide one for their staff.
Patch
Also called: update, security update
- In plain English
- A fix released by a software maker that closes a vulnerability. Installing updates is how you get the fix.
- Think of it like this
- The caretaker mending the door latch.Where that stops working: A patch only helps once it is actually installed.
- At work
- Keeping systems up to date is routine work and part of what vulnerability management teams do.
Penetration test
Also called: pen test, pentest, ethical hacking
- In plain English
- An authorised, agreed attempt to break into a system, carried out to find weaknesses so they can be fixed. The permission is the whole point.
- Think of it like this
- The school asking an outside expert to try every door and window one weekend, then write a report on which ones opened.Where that stops working: Without written permission it is not a test, it is a crime. See the section on the law.
- At work
- Penetration testers are paid to think like an attacker, with a contract that says exactly what they are allowed to try.
Phishing
Also called: scam email, smishing, scam text
- In plain English
- A message that pretends to come from someone you trust, sent to trick you into clicking a harmful link or handing over passwords or bank details.
- Think of it like this
- Someone in a school jumper who is not from your school walking up and saying the head sent them to collect everyone's locker keys.Where that stops working: A phishing message can be much more convincing than a stranger, because it can copy a real logo and a real name.
- At work
- Some organisations run practice phishing emails for their own staff, then explain the clues afterwards.
Ransomware
- In plain English
- A kind of malware that locks or scrambles a victim's files and demands payment to give them back.
- Think of it like this
- Someone swapping the padlock on your locker, then selling you the key.Where that stops working: Paying does not guarantee you get anything back, which is why backups matter so much.
- At work
- Incident responders help organisations recover from it and plan so it hurts less next time.
Red team and blue team
Also called: red teaming
- In plain English
- In an exercise, the red team plays the attacker and the blue team plays the defender, so an organisation finds out how well it really copes.
- Think of it like this
- A fire drill where somebody secretly hides a blocked exit and watches how the building copes.
- At work
- Both sides matter. Some people love the puzzle of attacking, others the satisfaction of spotting and stopping it.
Security operations centre
Also called: SOC, SOC analyst
- In plain English
- A team, often working in shifts, that watches an organisation's systems for signs of trouble and responds when something looks wrong.
- Think of it like this
- The control room in a hospital or an airport, with everyone watching screens and ready to act.
- At work
- Our Career Matrix lists SOC Analyst as an early role on the Cyber Security Technician apprenticeship route.
Social engineering
- In plain English
- Getting people, rather than computers, to do the wrong thing: using trust, pressure or curiosity to get past security without any clever technology.
- Think of it like this
- Saying 'Mr Patel said I could borrow the sports cupboard key' when he said nothing of the kind.
- At work
- It is why companies train everyone, not just the technical team, and why a polite phone call can be an attack.
Threat intelligence
Also called: threat intel
- In plain English
- Information about who is attacking, how and why, collected and explained so defenders can prepare.
- Think of it like this
- A teacher on duty knowing which corridors tend to get crowded, and when, so she is standing in the right place.
- At work
- Analysts collect and explain what they find, so writing clearly matters.
Two-step verification
Also called: 2SV, two-factor, 2FA, multi-factor, MFA
- In plain English
- Proving who you are in two ways, usually a password plus something else such as a code sent to your phone.
- Think of it like this
- A locker that needs both a key and a combination, so a stolen key alone is no use.
- At work
- It means a stolen password on its own is not enough to get in.
Vulnerability
Also called: weakness, bug, flaw
- In plain English
- A weak spot in software, a system or a process that an attacker could use.
- Think of it like this
- A fire door that does not quite latch. It is not a break-in, but it is how one could happen.
- At work
- Vulnerability management teams find, rank and fix these before someone else finds them.
Zero trust
- In plain English
- A way of designing security on the idea that nobody and no device is trusted just because they are inside the network. Every request is checked each time.
- Think of it like this
- Being asked to show your pass at every door, not only the front gate.
- At work
- A zero trust specialist is a role listed in our Career Matrix under Emerging Cyber.
For teachers
The Curriculum Translator
Pick an activity to see which curriculum statements it supports, or pick a statement to see which activities cover it. We have used only wording we read on the Department for Education's own pages, and we have been straight about where cyber security is not named at all.
Show the curriculum links for
| Stage | What the curriculum says | Activities that support it |
|---|---|---|
| Key stage 3 | “use technology safely, respectfully, responsibly and securely, including protecting their online identity and privacy”National curriculum in England: computing programmes of study | Spot the phish, Password maths lab |
| Key stage 3 | “recognise inappropriate content, contact and conduct, and know how to report concerns”National curriculum in England: computing programmes of study | Spot the phish |
| Key stage 4 | “understand how changes in technology affect safety, including new ways to protect their online privacy and identity”National curriculum in England: computing programmes of study | Password maths lab, An attack, step by step, Where hard hats meet hackers |
| Key stage 4 | “how to report a range of concerns”National curriculum in England: computing programmes of study | Spot the phish |
| GCSE computer science | “forms of attack (based on technical weaknesses and behaviour)”GCSE subject content for computer science | Spot the phish, An attack, step by step |
| GCSE computer science | “methods of identifying vulnerabilities”GCSE subject content for computer science | An attack, step by step |
| GCSE computer science | “ways to protect software systems (during design, creation, testing, and use)”GCSE subject content for computer science | An attack, step by step |
| GCSE computer science | “issues of privacy and cyber security”GCSE subject content for computer science | Password maths lab, Play it legally |
| GCSE computer science | “use appropriate security techniques, including validation and authentication”GCSE subject content for computer science | Password maths lab |
Be aware of the limits
- The key stage 3 and 4 programmes of study (published in 2013) do not use the words cyber security. The links above are to the statements on safe and secure use of technology and on privacy and identity.
- The GCSE content names cyber security only generally, under forms of attack, identifying vulnerabilities, protecting software and the ethical and legal impacts of technology.
- Encryption and ciphers are not named in either of the pages we read, so treat the Cipher Workshop as enrichment, and check your own exam board's specification for how it covers encryption.
- All of this is for England. Scotland, Wales and Northern Ireland have their own curricula, and curriculum documents are reviewed from time to time, so check the current version for your school.
Straight answers
Questions students, parents and colleagues ask
Do students have to be brilliant at maths or coding to work in cyber?
No, and the latest labour market report is quite clear about it. The most common specialism among UK cyber security businesses is governance and risk management, which is about decisions, policies and evidence, and a much smaller share employ people in security testing, the part most people think of as hacking.
People also arrive from all sorts of subjects. Among graduates working in cyber roles, 59% had studied a cyber security course and 18% computing, but 9% came from humanities or social sciences and 6% from business, accounting or economics. Coding helps in some roles and is irrelevant in others, so the honest answer is that it depends which part of cyber you mean.
Do you need a degree to get in?
Two things are true at once, and a student deserves to hear both. In the latest figures, 77% of employers required at least a bachelor's degree for a core cyber role and only 12% of roles were open to people with GCSEs or A levels.
At the same time, 65% of the cyber firms that had been recruiting and described steps to widen who applies said they had hired through non-degree routes. Apprenticeships are one of the routes we list in the career guides, though cyber apprenticeship enrolments fell by 15% in the latest year. So a degree is the most common requirement on a job advert, it is not the only way in, and the routes that avoid one are narrower.
Is it easy to get a first job in cyber?
It is worth being straight about this, because students will hear lots of excited headlines about skills shortages. Demand is real: 57% of UK businesses have a basic skills gap and the report estimates the sector needs about 10,200 people a year. But only 16% of core cyber postings in 2025 were open to someone with under a year of experience, down from 25% in 2022.
The useful message for a student is not 'cyber is easy' or 'cyber is closed', it is that early evidence of real skill matters: competitions, projects, work experience, an apprenticeship, a placement. That is a very teachable thing.
Are gamers better at cyber?
People say so a lot, and we went looking for the proof. We did not find a published study that measures whether gaming experience predicts how well someone does in a cyber job, so we are not going to claim it. What we can say is more practical: capture the flag competitions and practice platforms are games in their own right, and there are plenty of them.
The practical point for a teacher is the legal one. The NCA lists places where students can practise legally, including CyberLand, OverTheWire, Cyber Explorers, Hack The Box and British Esports. And it gives knocking an opponent offline with a booter as an example of an offence.
Is it legal for students to try hacking?
Only on a system built to be practised on, or one they have clear permission to test. Under the Computer Misuse Act 1990 it is an offence to access a computer without permission, and downloading hacking tools can be an offence even if they are never used. The NCA says many young people commit cyber crime without realising it.
That is not meant to frighten anyone. It is why we point students at legal platforms and competitions, and why the NCA runs Cyber Choices, which names teachers as one of its audiences. If you are ever worried about a student, that is who to talk to.
Is it all sitting at a desk looking at screens?
No. Our Career Matrix separates desk-based routes from genuinely physical, on-site ones, which we call Hard Hat routes, and one of them sits inside cyber itself: Operational Technology security, with roles such as OT Security Engineer and ICS Security Analyst. These protect the control systems for physical equipment like pumps, switches and factory machines.
Beyond cyber, five of our eight career families have a hands-on route, from fibre engineering and data centres to industrial automation and, in Data & AI, surveying with mapping drones. Digital systems all sit on physical equipment, and someone has to install and look after it.
What about drones?
Drones show up in two places. On the hands-on side, our Data & AI family includes a geospatial surveying route where people pilot mapping drones. On the cyber side, the Career Matrix gives the example of securing a fleet of autonomous drones from signal hijacking.
If a school wants to start a drone club, the rules changed on 1 January 2026: a Flyer ID, from a free theory test, is now needed for any drone over 100g, and there are specific rules for under-18s and under-13s.
Is our own school really a target?
Schools are in the data. In the most recent survey, 60% of secondary schools and 44% of primary schools had identified a breach or attack in the previous 12 months, and the most common type was phishing. The sample is small and counts only what schools noticed themselves, so treat the numbers as indicative.
It makes a good opening for a class: this is not something that happens to other people.
What should someone do with a scam message?
Stop, break contact and think about what the message is trying to make you feel. Then check with the organisation using details you find yourself, not the ones in the message.
Suspicious texts can be forwarded to 7726 and suspicious emails to the NCSC. Reporting to the NCSC is not reporting a crime, so if money has been lost, report it to Report Fraud, or to Police Scotland on 101 in Scotland.
What is the best way to choose a password?
The NCSC recommends three random words. The word random matters: avoid dates, teams, names of family and pets, because that kind of information is often easy to find online. And swapping an 'o' for a zero does not make a password meaningfully stronger. Try the Password Maths lab to see why length does most of the work.
Coming from employers
From the industry
Resources shared by employers
The first employer resources are on their way. If you work for an employer with a TechSkills portal account, you can share a resource from your portal and it will appear here once it has been reviewed.
Articles and stories
Policy & Research
What It Takes to Scale the Responsible Adoption of Agentic AI
Drawing on a four-part 2026 workshop series, techUK sets out what it actually takes to move agentic AI beyond pilots - covering technical readiness, organisational ownership, workforce AI literacy and governance - alongside what it wants from government.
Policy & Research
DSIT's AI Assurance Roadmap Takes Its Next Step
techUK will lead the new Industry Advisory Group within the government's AI Assurance Consortium, working to build the UK's first agreed skills framework and career pathways for AI assurance - a fast-growing profession worth over £1 billion today and projected to reach around £19 billion by 2035.
Industry Insights
Event Round-Up: Future Careers in Emerging Tech
A round-up of techUK's Future Careers in Emerging Tech event, where panellists made the case that routes into AI, quantum, cybersecurity and semiconductors run through far more than traditional STEM degrees - and that soft skills matter just as much as technical ones.
University & Provider Spotlights
Contribute to Our TechTogether 2026 Campaign
techUK's month-long March diversity and inclusion campaign is built around four themes, from career pathways to equity by design, and is open to member contributions in blog, interview or short video form.
Industry Insights
New Cyber Security Degree Apprenticeship Available
The University of Gloucestershire’s BSc Cyber Security degree apprenticeship programme has now been accredited as Tech Industry Gold, with the unanimous support of all employers involved in the accreditation process.
Over the coming months this is where employers will add their own articles, videos, lesson ideas and day-in-the-life stories for teachers. Nothing appears here until the TechSkills team has read it and published it, and every piece names the organisation that shared it.
Where to next
Careers guides for Cyber Security
Every area of work in cyber, the routes in, pay and hiring, and the skills employers ask for, with sources and dates, are in our Cyber Security guides. There is one for teachers and one for careers advisers.
Show your working
Sources and how we checked them
Each source below was opened and read on 1 November 2026, and every figure on this page is the one the source gives, with the condition the source puts on it. Where we looked for evidence and did not find it, as with gamers and cyber performance, we say so rather than fill the gap. If you spot something that has changed, tell us and we will fix it.
- Cyber security skills in the UK labour market 2026Department for Science, Innovation and Technology (research by Ipsos and Perspective Economics). Published 29 September 2026.Used for: The size of the cyber workforce, skills gaps, job postings, entry-level and degree requirements, and how firms recruit.
- Cyber security sectoral analysis 2026Department for Science, Innovation and Technology (research by Ipsos and Perspective Economics). Published 12 May 2026.Used for: The number of UK cyber security firms, the jobs they provide and their revenue.
- Cyber security breaches survey 2025: education institutions findingsDepartment for Science, Innovation and Technology and the Home Office. Updated 19 June 2025.Used for: How many schools, colleges and universities identified a breach or attack, and the most common type.
- Phishing scams: how to spot and report themNational Cyber Security Centre (NCSC). Published 26 November 2021, reviewed 5 September 2022.Used for: The five tell-tale signs of a scam message, and what to do when one arrives.
- Report a scam emailNational Cyber Security Centre (NCSC). Published 26 November 2021, reviewed 5 September 2022.Used for: How to report a suspicious email, what happens to it, and where to report fraud.
- Report a scam text messageNational Cyber Security Centre (NCSC). Page shows no date.Used for: That suspicious text messages are forwarded to 7726.
- Three random wordsNational Cyber Security Centre (NCSC). Published and reviewed 21 December 2021, version 2.0.Used for: The advice to build passwords from three random words, and what to avoid.
- Schools (education and skills)National Cyber Security Centre (NCSC). Page shows no date.Used for: What the NCSC offers schools: CyberFirst courses and competitions, CyberSprinters games, staff training.
- Cyber ChoicesNational Crime Agency (NCA). Page shows no date.Used for: The Computer Misuse Act 1990 in plain terms, the consequences of breaking it, and legal places to practise.
- National curriculum in England: computing programmes of studyDepartment for Education. Published 11 September 2013 (England only).Used for: The key stage 3 and 4 statements on safe and secure use of technology.
- GCSE subject content for computer scienceDepartment for Education. Updated 31 March 2025, for teaching from 2025 (England only).Used for: The GCSE computer science content on forms of attack, identifying vulnerabilities and protecting software.
- Regulator calls on new and existing drone users to learn new rules before taking offCivil Aviation Authority (CAA). Published 29 December 2025.Used for: The UK drone rules in force from 1 January 2026: Flyer ID, the free theory test, and the rules for children.
- MITRE ATT&CK enterprise tacticsThe MITRE Corporation. ATT&CK version 20, as shown on the page.Used for: The names and order of the tactics an attacker uses, which the attack diagram simplifies.
- TechSkills Career Matrix and Career PlannerTechSkills. Pay, hiring and route data last checked from 11 July 2026.Used for: Cyber roles, the hands-on routes (including Operational Technology security) and pay, each with its own source and date in the career guides.
This page is general information to help with teaching. It is not legal advice, and for England the curriculum links should be checked against the version your school currently follows.