School security: know someone is on the roof tonight, not tomorrow

Last updated 31 October 2026. A school is one of the busiest buildings in any community during the school day, and one of the emptiest the rest of the time. Evenings, weekends and the long holidays leave classrooms, halls, playgrounds and car parks unwatched, often in the middle of housing estates where people walk past every night. That is when most of the damage happens: fires in bins and against walls, people on flat roofs, broken windows, graffiti, break-ins for laptops and tablets, and cars meeting in the staff car park. This guide covers what the official figures show, what the Department for Education (DfE) expects from schools and colleges, how to reduce the arson risk, where cameras should watch, what DfE says about CCTV and data protection, and how AI detection on the cameras a school already has can tell the caretaker or the head that someone is on site while there is still time to act.

Why are schools at risk out of hours?

Schools have everything that makes a site attractive to vandals, thieves and fire-setters. They are large, with long boundaries and many doors. They are usually empty from late afternoon until early morning and for long stretches in the holidays. They are well known to local young people, who know the layout, the blind spots and the places to climb. Many older buildings have flat roofs, timber cladding or large areas of glazing, and some are built largely from timber. And they hold things worth taking: laptops, tablets, projectors, catering equipment, and metal on roofs and in plant rooms.

DfE lists the threats directly. Its guidance on potential security threats and preventative measures names arson, theft, vandalism, trespass, malicious damage and graffiti among the crimes schools and colleges should consider, alongside threats to people. Its main school and college security guidance asks every setting to think about how it is protected outside the school day as well as during it.

The out-of-hours problem is not only crime. A fire that starts in an empty building at night has longer to grow before anyone notices, and a school with nobody in it cannot raise its own alarm unless something is watching. That is why the focus of this guide is the hours when the building is closed.

How many school fires are there?

Official fire statistics for England record every fire attended by fire and rescue services, broken down by type of building. Table FIRE0301, part of the fire statistics data tables published by the Ministry of Housing, Communities and Local Government (MHCLG), shows primary fires in education premises, which covers schools, colleges and other education buildings.

Education premises

In the year ending March 2026, fire and rescue services attended 445 primary fires in education premises in England. Of these, 65 were recorded as deliberate and 380 as accidental, so roughly one in seven was started on purpose. That is a long way down on 2010/11, when there were 855 fires, 215 of them deliberate: a fall of about 48% in all fires and about 70% in deliberate fires over fifteen years.

Fifteen years

The trend is not straight down. Fires fell to 333 in 2020/21, the first pandemic year, when many schools were closed or only partly open, and rose again to 523 in 2022/23 as schools returned to normal. The 2025/26 figure of 445 is higher than the 417 of the year before. Behind each number is a fire serious enough to bring a fire engine, and for a school even a small one can close classrooms, destroy coursework and displace pupils.

Insurers see the cost. Zurich Municipal, which insures many schools, reported in February 2023 that Home Office figures showed 219 primary and secondary schools damaged by fire in 2021/22, up from 162 the year before, an increase of 35%. The same article noted that Scotland and Wales require sprinklers in all new and majorly refurbished schools while England does not, and that a survey of more than 20,000 school exteriors found nearly 800 schools built from wood.

Why are the summer holidays the riskiest time?

The longer a building stands empty, the longer a break-in, a fire or a burst pipe goes unnoticed. Zurich Municipal’s July 2026 advice to schools before the summer holidays draws on its claims data from 2021 to the present. Theft makes up 13.4% of the school claims it receives in August, against 8.8% for the rest of the year. Escape of water rises to 24% of claims in August, against 18% in other months.

August

Holidays are also when work happens on site. Contractors come and go, doors are propped open, skips and materials appear, and fire alarms are sometimes isolated for building work. Our construction site fire safety guide covers the risks of works in progress. A school’s security plan should say how the site is protected and checked through each holiday, and who is responsible on each day.

What does DfE expect from schools and colleges?

DfE’s school and college security guidance, last updated on 3 July 2026, is non-statutory, but it sets out what every school and college in England should have in place. In summary, it asks settings to:

• Have a security policy and plan. To manage and respond to security incidents, based on a realistic assessment of the threats to the setting, and reviewed routinely.
• Name a competent person. Someone with the knowledge and time to lead on security, with access to specialist advice where needed.
• Assess the risks. Identify the threats that could affect the setting, how likely each one is, what the impact would be, and how to respond.
• Plan for out of hours. Plans should cover incidents during normal hours and out of hours, including weekends and holidays, and extended services that take place on the premises.
• Work with partners. The police, the local authority or academy trust, and local resilience forums can all advise and help.

A security plan

Fire safety is a legal duty. Under article 9 of the Regulatory Reform (Fire Safety) Order 2005, the responsible person must make a suitable and sufficient assessment of the fire risks and keep it under review. Building Bulletin 100 explains that in maintained schools responsibility for fire safety is usually shared between the local authority, the governing body and the head teacher; in academies it sits with the trust. The Home Office guide to fire safety risk assessment in educational premises walks through the process, and DfE’s guidance on fire safety in new and existing school buildings explains how the rules apply to schools. Building Bulletin 100 calls arson a particular problem for schools.

DfE’s good estate management guidance on health and safety adds that schools should assess the risks of people entering or leaving the estate, and that the perimeter should be secured and controlled accordingly. Scotland, Wales and Northern Ireland have their own guidance, but the same principles apply.

What security measures does DfE suggest?

DfE’s list of potential threats and preventative measures pairs each type of threat with measures schools can consider. For crime against the site, such as arson, theft, vandalism and trespass, the measures include:

• CCTV. To monitor and record activity within and around the estate.
• Access control. Integrated systems to control, monitor and deny access when necessary.
• Intrusion detection. For example effective perimeter fencing, security lighting and security glazing.
• Intruder alarms. To raise the alarm when someone gets into the building.

None of these works on its own. The main guidance adds that a well maintained estate can act as a visible deterrent, and that good access control and security lighting make it harder for an intruder to get in. A fence slows people down, lighting makes them visible, cameras record them, and alarms and alerts tell someone they are there. The gap in many schools is the last part: cameras that record all night, with footage that nobody looks at until the morning after.

How can schools reduce the risk of arson?

DfE’s design guide Building Bulletin 100, Design for fire safety in schools, has a section on arson. It explains that many attacks are opportunistic and that good security is a major factor in reducing them, and sets out five objectives for managing the risk.

Five objectives

In practice, those objectives point to a short list of actions that cost little and make a large difference:

• Move the bins. Building Bulletin 100 advises keeping rubbish containers in locked areas well away from buildings. Wheeled bins pushed against a wall, or under a canopy, are a common starting point for fires that spread into the building.
• Stop people climbing. Keep anything that could be used as a step, such as bins, benches and stacked furniture, away from low roofs, and remove footholds where you can. Preventing access to roofs is singled out as important.
• Light the hidden places. Recesses, courtyards and the backs of buildings where someone can work unseen.
• Tidy up. Clear combustible rubbish, pallets, leaves and stored materials from around buildings, especially near doors and under windows.
• Lock up properly. Close windows, lock doors and set the alarm, every night, including during holidays and lettings.

On CCTV, Building Bulletin 100 makes a point that matters for every school: CCTV surveillance may act as a deterrent, “although some insurers only believe it is beneficial if constantly monitored enabling a rapid response”. Recording alone shows how a fire started. Watching the feeds and raising an alert is what gives a chance to stop it. Our arson prevention guide covers deliberate fire on all kinds of sites.

Where should cameras watch on a school site?

Start with where trouble happens and the routes people take to get there. On most school sites that means the roofs, the bin stores, the playground and field, the car parks, the entrances and the fence line. DfE’s good estate management guidance on digital technology describes the same idea, suggesting CCTV covers the secure line round the site, the building perimeter, obscured areas and any internal high-risk areas.

Site plan

Many schools already have cameras round the buildings, recording to a recorder in the office or a comms cupboard. If they are IP cameras, or the recorder supports RTSP or ONVIF, AI detection can usually be added to them without new cameras. Check what each one sees at night, whether it is lit or has infrared, and whether it is high enough to be out of reach.

Keep the zones inside the school boundary. A camera on the perimeter will often see the footpath, the road and the front gardens opposite. Drawing the zone on the school’s own playground or car park, not the whole picture, means people walking past do not set off alerts, and keeps cameras pointed where they should be for privacy.

What does DfE say about CCTV in schools?

DfE’s digital technology guidance gives practical advice on choosing and running CCTV. In summary, it suggests:

• Image quality. Cameras of at least 1080p resolution, with infrared for night-time images, so footage is clear enough to be useful.
• Weatherproofing. External cameras rated at least IP66, so they keep working in wind and rain.
• IP-based cameras. Securely connected to the school or college’s network.
• Secure recording. Footage recorded to dedicated network video recorders, physical or server, or a secure cloud service, with a plan for backups.
• Monitors out of public view. Monitors and the reviewing of images should not be in public view, and images should be available to download securely for the police.
• Coverage. The secure line, building perimeter, obscured areas and internal high-risk areas, possibly with advice from an independent security expert.
• Alerts that are useful. Make sure alerts are received in a way that is timely and useful.
• The DPO. Work with the data protection officer on how CCTV is used.

That point about alerts is the heart of it. A camera that records an intruder on a roof at 01:36 is evidence. A camera that tells the caretaker or a keyholder at 01:36 gives them the chance to call the police before the damage is done.

How does AI detection on school CCTV help?

Ordinary CCTV records. Footage is usually looked at the next morning, if at all. Woodcock AI watches the feeds from the cameras a school already has, and raises an alert when something that matters happens, so someone can act while it is still happening.

• Intrusion detection. Flags a person in a zone you draw, such as a roof, the playground or the area by a fire exit, during the hours you choose. See intrusion detection.
• Line crossing. Flags a person or vehicle crossing a line you draw, such as the top of the perimeter fence or the vehicle gate. See line-crossing detection.
• Vehicle detection in zones. Flags a vehicle entering a zone, such as the staff car park, after the site closes. It is not number plate recognition. See vehicle detection.
• Smoke and fire detection. Flags visible smoke and flame, such as a bin set alight against an outside wall, where the building’s fire alarm cannot sense it. See smoke and fire detection.
• Polygon zones and schedules. You draw each zone to fit the area, such as the playground but not the footpath beside it, and set when it is armed. See polygon detection zones.
• Self-learning. The system learns from feedback on alerts at your site, so it gets better at telling real events from things that are not, such as foxes, swaying trees or headlights. See self-learning AI.

Each alert goes to the app with a snapshot and a short clip, and by email, so the caretaker, the business manager, a keyholder or a security firm can see in seconds what is happening. Detection runs on an edge server on site or on a cloud server, and connects to IP cameras and recorders over RTSP or ONVIF, including Hikvision. Woodcock AI detects people and vehicles; it does not identify who anyone is. You will also soon be able to ask your cameras questions about what happened on site; Ask your cameras is coming soon, early 2027.

This speaks to the point Building Bulletin 100 makes about insurers. Cameras that are watched all the time and that prompt a rapid response are worth more than cameras that only record. AI detection is a way to have every camera watched every night, with people only called on when something actually happens.

How do schedules work around the school day?

A school is full of people for part of the day and empty for the rest, so detection has to follow the timetable. Each zone has its own schedule:

• Roofs. Armed 24 hours a day. Nobody should be on a roof without the caretaker knowing, and maintenance can be planned around it.
• Bin stores. Smoke and fire detection on all the time, because a bin fire is just as dangerous at lunchtime.
• Playground, field and car park. Armed from when the site closes until the caretaker opens up, and all day at weekends and in holidays.
• Entrances and fire exits. Armed out of hours, so someone at a door after dark is flagged.

During the school day, the intrusion zones in busy areas are simply not armed. That keeps alerts to the times when a person on site means something, and avoids treating pupils, staff and parents as events. Woodcock AI does not identify individuals, does not use facial recognition and does not track pupils.

That distinction matters in schools. Under section 26 of the Protection of Freedoms Act 2012, schools must notify parents and get consent before processing a child’s biometric information, for example for fingerprint cashless catering. Detection that flags a person in a zone, without working out who they are, is a different kind of processing, but you should still record how it works in your data protection documents and check it with your DPO.

What about lettings, cleaners and the caretaker?

Many schools are busy well after the pupils leave. Cleaners work into the evening, the caretaker locks up, and halls and pitches are let to clubs, churches and community groups. Each of those needs to fit around detection without a stream of alerts.

• Cleaners. Arm outdoor zones from when the cleaning team usually leaves, or start with the zones they never enter, such as roofs and the field.
• Lettings. Leave the zones around the hall entrance and the car park unarmed until the booking ends, and keep the rest of the site armed.
• The caretaker. Decide whether the caretaker or site manager gets alerts out of hours, and who covers when they are off.

Old motion detection flagged any change in the picture, from a moving branch to rain on the lens. AI detection looks for specific things, such as a person or a vehicle, inside a zone or crossing a line, during the hours you set. Mark alerts as useful or not, and the self-learning system uses that feedback to improve at your site. Our guide to reducing CCTV false alarms has more detail.

How does data protection apply to school CCTV?

CCTV in a school captures pupils, staff, parents and visitors, so it has to follow data protection law. DfE’s guidance on using CCTV in schools summarises what that means. In short, schools should:

• Define the purpose. Be clear why cameras are there, such as protecting the site out of hours, and use them only for that.
• Consider less intrusive options. And carry out a data protection impact assessment (DPIA) where the use is likely to be high risk, consulting the DPO.
• Consult and inform. Talk to pupils, parents and staff, put up clear signs and update privacy notices.
• Limit access. Only trained and authorised staff should be able to access footage, with clear processes for reviewing it.
• Set a retention period. Data protection law sets no minimum or maximum period; the purpose decides it, and footage is deleted securely in line with the retention policy.
• Handle requests. People can ask for footage of themselves through a subject access request, which should be answered within one calendar month.

The guidance also notes the other laws that may apply, including the Freedom of Information Act 2000, the Protection of Freedoms Act 2012, the Human Rights Act 1998 and the Surveillance Camera Code of Practice. The Information Commissioner’s Office publishes detailed guidance on video surveillance, and our guide to GDPR and AI CCTV covers AI detection specifically.

Polygon zones help here. Drawing zones on the school’s roofs, yards and car parks, arming them only when the site is closed, and leaving footpaths and neighbours’ gardens out keeps detection to what the purpose needs.

What should happen when an alert fires?

Agree the plan before you need it, and write it into the security policy. Who gets alerts at night, at weekends and in holidays? Who checks the clip? When is it a 999 call? Who tells the head, the trust or the council?

Out of hours

• Check the clip. It shows within seconds whether it is a fox, the caretaker, a lettings group leaving late, or someone on the roof.
• Call 999 for a fire or a crime in progress. Give the school’s address, the part of the site and what you can see.
• Never go alone or confront anyone. Use a keyholder service or a security firm where you have one, and wait for the police.
• Record and review. Save the clip, report the incident, tell the people who need to know, and fix what let it happen, such as a bin by a wall or a gap in the fence.

Where the police are not needed straight away, report crime to the local force through 101 or online. Many forces have officers who work with schools and can advise on repeated problems.

What should be on a pre-holiday security checklist?

Before each holiday, and especially the summer, walk the site with the security plan in hand. A short checklist might include:

1. Bins. Empty them, lock them away from buildings and check the bin store camera can see them.
2. Climbing aids. Move benches, bins, ladders and furniture away from low roofs.
3. Combustibles. Clear rubbish, pallets and stored materials from around buildings.
4. Doors and windows. Check locks, close windows and make sure fire doors shut.
5. Alarms and cameras. Test the intruder alarm and fire alarm, check every camera has a clear picture at night, and set zones to their holiday schedules.
6. Contacts. Confirm who gets alerts and keyholder calls on each day of the holiday.
7. Contractors. Agree how works are kept secure, and how hot work and isolated alarms are managed.
8. Water. Isolate water systems where possible, as Zurich advises, given that escape of water claims rise in August.

How do you get started?

Walk the site after dark. Note the roofs people can climb, the bins against walls, the places that have been damaged before and the routes people take across the site. Check what cameras you already have, what they see at night, and where they record.

Our site assessment looks at the cameras already on the school site, the parts of it most at risk, and the zones, lines and schedules that would cover them, including around lettings and the caretaker’s hours. If you want to see it working first, we can run a live test on your cameras: we connect two or three of them for about a fortnight, so you see alerts on your own site before you decide. An on-site demo is also available. Trusts with several schools can start with one site and extend from there. See also the sectors we work with and our out-of-hours site security checklist.

What are the limits?

• A camera needs a view. It cannot see a roof or a wall it does not point at.
• It needs light or a camera that works in the dark. Check what your cameras see at night.
• It needs power and a connection. If either goes off, cameras and alerts stop.
• It does not replace the fire alarm, intruder alarm or sprinklers. It adds an early warning from what cameras can see.
• It does not read number plates or identify people. It flags people and vehicles in zones and on lines, and smoke and flame; the clip shows what happened.
• Someone has to respond. An alert is only useful if someone acts on it.

Sources

• Ministry of Housing, Communities and Local Government, Fire statistics data tables, table FIRE0301 (published 22 July 2026).
• Department for Education, School and college security (updated 3 July 2026).
• Department for Education, Potential security threats and preventative measures.
• Department for Education, Good estate management for schools: digital technology in your estate.
• Department for Education, Good estate management for schools: health and safety.
• Department for Education, Data protection in schools: taking and using photos and videos, and using CCTV.
• Department for Education and Skills, Building Bulletin 100: Design for fire safety in schools (2007).
• Department for Education, Fire safety in new and existing school buildings.
• Home Office, Fire safety risk assessment: educational premises.
• legislation.gov.uk, Regulatory Reform (Fire Safety) Order 2005, article 9.
• legislation.gov.uk, Protection of Freedoms Act 2012, section 26.
• Zurich Municipal, Government snub for sprinklers in schools putting pupils’ lives at risk (2 February 2023).
• Zurich Municipal, Five ways to protect your school before the summer holidays (6 July 2026).
• Information Commissioner’s Office, Guidance on video surveillance, including CCTV.
• Secured by Design, Design guides, including guidance for schools.

We have summarised these sources in our own words. Always read the current versions in full. This page is general guidance, not legal, insurance, fire safety or security advice; your local authority or trust, your insurer, the fire and rescue service, the police and a competent adviser decide what applies to your school.

Frequently asked questions

Last reviewed 31 October 2026