Understanding Online Safety in Schools: What KCSIE 2025 Really Requires
A safeguarding concern doesn’t always look like a safeguarding concern.
It might look like a student quietly withdrawing after spending more time online.
A message that feels slightly off but not obviously harmful.
Or a request that seems routine — until you look back on it later.
This is where most online safeguarding decisions actually happen. Not in policy documents, but in everyday moments where something feels normal enough to continue.
In today’s schools and colleges, safeguarding doesn’t stop at the school gate — it extends across devices, platforms, and digital behaviours. The Keeping Children Safe in Education (KCSIE) statutory guidance reflects this reality and makes it clear: online safety is not optional.
Cybersecurity and digital awareness now sit at the heart of safeguarding strategy. Whether you’re a Designated Safeguarding Lead, headteacher, ICT coordinator, or classroom teacher, the challenge isn’t just understanding what KCSIE says — it’s applying it in situations that don’t always look like risk.
This guide breaks down the key expectations, explains why they matter, and shows what they look like in practice.
Safeguarding in a Digital World
The digital environment is no longer something young people step into—it’s something they’re already part of.
It runs alongside everything else: lessons, friendships, disagreements, identity, and everyday communication. Because of that, safeguarding doesn’t just extend into the digital world. It now sits within it.
The challenge is that risk doesn’t usually present itself in obvious ways.
It rarely looks like something clearly harmful or inappropriate. More often, it looks like something familiar—a message from someone they’ve spoken to before, a piece of content shared between peers, or a platform they use every day without thinking twice about it.
Nothing immediately stands out, and that’s exactly where safeguarding becomes more complex.
From a school perspective, the difficulty isn’t just understanding the types of risks that exist. It’s recognising when something ordinary might need a second look. A student engaging in a conversation that feels normal on the surface. A pattern of behaviour that doesn’t quite sit right but isn’t clearly concerning in isolation. A situation that develops gradually rather than appearing as a single incident.
These are the moments where safeguarding decisions are actually made.
They don’t happen in controlled environments or clearly defined scenarios. They happen during busy school days, alongside teaching, behaviour management, and pastoral care. Staff are making judgement calls in real time, often with incomplete information, and students are navigating digital spaces in ways that feel entirely natural to them.
That’s why KCSIE places such strong emphasis on a whole-school approach to online safety.
This isn’t just about having the right policies or technical systems in place. It’s about building a shared understanding of how risk actually develops in everyday situations. How familiarity influences trust. How time pressure affects judgement. How context changes the meaning of what we see.
Because safeguarding in a digital world isn’t just about identifying harmful content or preventing access to certain platforms.
It’s about recognising when something that appears normal might not be.
And having the confidence to pause, question, and act on it.
What KCSIE Says About Online Safety and Cybersecurity
KCSIE 2025 doesn’t treat online safety as something separate from safeguarding. It reflects a shift that most schools are already experiencing — that safeguarding increasingly takes place in digital spaces as much as it does in physical ones. Students move between the two constantly, often without any clear boundary. Conversations continue outside the classroom, behaviour online influences what happens in school, and situations can develop gradually rather than appearing as obvious incidents.
That’s why online safety is positioned as part of a whole-school safeguarding approach. Not as an additional responsibility, but as something embedded into how safeguarding already works. This isn’t a theoretical shift — it reflects how risk actually appears in everyday school life, where concerns rarely present themselves clearly and decisions are made in real time.
Staff Training and the Reality of Safeguarding Decisions
KCSIE states that all staff should understand the online risks children may face and know how to respond appropriately. This requirement exists because safeguarding rarely breaks down through a lack of awareness. It breaks down in moments where something doesn’t quite look like a safeguarding concern — or doesn’t feel serious enough to act on straight away.
In practice, staff are not dealing with clearly defined incidents. They are interpreting fragments of information. A student might mention something in passing that doesn’t immediately raise concern. A message might be shown that seems harmless without context. A behaviour might feel slightly unusual, but not enough to justify escalation on its own.
These situations don’t come labelled. They sit in the grey area where judgement matters.
This is why training needs to go beyond explaining risks. It needs to prepare staff for how those risks actually present themselves — in busy environments, alongside competing priorities, and often without complete information. Because the safeguarding decision is rarely about spotting something obvious. It’s about recognising when something needs a second look, even if it appears normal on the surface.
Leadership, Systems, and the Limits of Technology
KCSIE also requires leaders and governors to ensure appropriate filtering and monitoring systems are in place. This reflects the need to reduce exposure to harm and identify potential concerns early. But the guidance doesn’t position technology as the solution — because technology alone cannot interpret safeguarding risk.
Filtering can block access to certain content, and monitoring systems can flag keywords or behaviours. But they cannot understand intent, relationships, or context. That responsibility sits with staff, who must interpret what they see and decide whether it requires action.
In practice, this often means looking beyond what is immediately visible. A flagged concern might seem minor in isolation but become more significant when viewed over time. A conversation between students might appear appropriate on the surface but take on a different meaning depending on tone, history, or context. Even where systems are working as intended, safeguarding still relies on human judgement.
This is why KCSIE emphasises both systems and understanding. One supports the other — but neither works effectively in isolation.
Teaching Online Safety as Everyday Behaviour
KCSIE places clear emphasis on teaching online safety across the curriculum, not confining it to a single subject. This reflects the reality that digital behaviour is not something students switch on and off — it is part of how they communicate, interact, and make decisions every day.
Students are not encountering risk in structured, clearly explained scenarios. They are navigating it in real time, through social interactions, messaging platforms, and online environments that feel familiar. Decisions are often made quickly, influenced by peers, and shaped by what feels normal within their social context.
This is why online safety education needs to go beyond explaining risks. It needs to help students understand how those risks actually appear in the situations they already experience. That includes recognising when trust is being manipulated, understanding how behaviour can escalate over time, and feeling confident enough to question something that doesn’t feel quite right.
In practice, this means moving away from one-off lessons and towards a consistent, embedded approach — where online safety is reinforced across subjects, conversations, and everyday school life.
Emerging Risks and the Challenge of Interpretation
KCSIE also highlights the growing impact of emerging risks, including AI-generated content, deepfakes, anonymous platforms, and increasingly sophisticated forms of online manipulation. This reflects a changing landscape where risk is becoming harder to identify, not easier.
These developments matter because they reduce the visibility of warning signs. Messages can be highly convincing. Identities can be harder to verify. Content can be manipulated in ways that appear completely authentic. As a result, the challenge is no longer just recognising known threats, but interpreting situations where the risk is less obvious.
In practice, this means that safeguarding decisions become more complex. Staff and students are more likely to encounter situations that feel legitimate but carry underlying risk. The signals are more subtle, the context is more important, and the margin for uncertainty is higher.
This is why KCSIE emphasises staying up to date — not just with specific threats, but with how those threats are evolving. Because while the tools may change, the underlying challenge remains the same.
Safeguarding decisions are still made in moments where something feels normal enough to continue.
The difference is that those moments are becoming harder to interpret.
Understanding the Four Cs of Online Risk
KCSIE uses the Four Cs framework to help schools understand the different ways online risk can affect children and young people. It groups risk into four areas: content (what children see), contact (who they interact with), conduct (how they behave), and commerce (how they may be exploited financially or through data). On the surface, this is a simple way of organising risk, but the reason it is included in the guidance goes beyond categorisation.
The framework reflects how online harm actually develops. Risk does not usually appear as a single, clearly defined issue. It often builds through interaction over time, moving between different types of behaviour and exposure. A student might encounter harmful content through something shared by a peer, begin interacting with someone they believe they know, and gradually become involved in behaviour that places them at risk. What starts as something routine can develop into something more serious without there ever being a single obvious point where it becomes a safeguarding concern.
This is why the Four Cs are useful. They shift the focus away from trying to label risk in isolation and towards understanding how it evolves. In practice, this helps schools look beyond individual incidents and consider the wider context. Instead of asking what type of risk something falls into, staff are better able to consider how the situation started, how it developed, and what influenced the decisions made along the way.
For a deeper breakdown of how each of these areas presents in real school environments, including practical examples and early warning signs, you can explore our detailed guide to how content, contact, conduct and commerce risks actually appear in everyday school life.
Why Cyber Awareness Training Is Non-Negotiable
Most schools aren’t lacking awareness of online risk. Staff already understand the basics — they know phishing exists, they know students can be exposed to harmful content, and they are aware of risks like grooming and cyberbullying. The issue isn’t knowledge. It’s that most training never goes beyond it.
What schools are typically given is surface-level awareness. It explains what risks look like in theory, but it doesn’t reflect how those risks actually appear in day-to-day school life. It assumes that when something is wrong, it will be obvious enough to recognise and act on. In practice, that’s rarely the case.
Safeguarding concerns tend to develop gradually. They show up through small, seemingly disconnected moments — a comment that doesn’t quite sit right, a change in behaviour that feels subtle rather than significant, a situation that only becomes clear when looked at over time. Staff don’t miss these things because they are unaware of risk. They miss them because, at the point where a decision needs to be made, the situation doesn’t feel like a safeguarding issue.
That gap becomes even more noticeable as the digital environment continues to evolve. AI is making communication more convincing, not less. Messages that would once have raised suspicion now feel routine. Content can be manipulated in ways that are difficult to detect. Identities are easier to imitate, and interactions that appear genuine can carry underlying risk. The expectation that people can simply “spot the signs” becomes less realistic when those signs are no longer clear.
This is where traditional awareness training starts to fall short. It focuses on recognition without addressing how decisions are made in real situations, where time, context, and familiarity all influence how something is interpreted. Staff are not making safeguarding decisions in controlled environments; they are making them during busy school days, alongside competing responsibilities, often with incomplete information.
Training becomes non-negotiable at the point where schools recognise that safeguarding is not just about knowing the risks, but about responding to them in the moment. When training reflects how situations actually unfold, it changes how staff interpret what they see. They become more confident questioning situations that would previously have been accepted at face value, more able to connect small concerns into a wider picture, and more consistent in how they respond.
This is not about adding more content or increasing the volume of training. It is about making it more relevant to the decisions staff are already making every day. Because safeguarding does not usually break down through a lack of awareness. It breaks down in ordinary situations where everything feels routine enough to continue, and where the decision to pause, question, or act is not always straightforward.
In most schools, these moments don’t stand out.
A comment is heard, a behaviour is noted, a situation is allowed to continue — because nothing feels clearly wrong at the time.
Which is why safeguarding doesn’t usually break down through a lack of awareness.
It breaks down in the moments where something feels normal enough to move past — and the decision to pause isn’t always obvious.
This is often the point where it’s worth stepping back and looking more closely at how those decisions are actually being made in practice.
Director of Training and Development, Cyber Rebels.
Andy Longhurst is the founder of Cyber Rebels and a cybersecurity practitioner and educator focused on how risk actually shows up in real organisations. His work sits at the intersection of digital safety, education, and practical risk management — helping teams understand not just what policies say, but what happens in the moments where decisions are made under pressure.
With a background spanning adult education, web development, and technical consultancy, Andy specialises in translating complex security concepts into clear, usable understanding. Rather than focusing solely on tools or compliance frameworks, his approach centres on human behaviour, judgement, and the systems that shape everyday choices.
He delivers live, interactive cyber awareness training for organisations of all sizes, from small businesses and education providers to public-sector teams and larger organisations operating in complex risk environments.
Outside of delivery, Andy spends his time analysing emerging attack patterns, refining training design, and exploring how organisations can build resilience that holds up in the real world — usually with a strategically sized cup of tea close to hand.
