Governance & Risk Management
,
Identity & Access Management
,
Patch Management
Decentralization and Sprawl Complicate University IT Programs
Higher education CIOs are working in unique environments where openness and innovation thrive, but recent high-profile breaches at elite institutions show the challenges they face in keeping systems secure.
See Also: Zero Trust Under Strain as Organizations Favor Just-in-Time Access
Several Ivy League universities – including Harvard and Princeton – experienced hacks in 2025 through unpatched enterprise software and sophisticated social engineering campaigns, showing that even the nation’s wealthiest universities are vulnerable.
To combat these rising threats, university CIOs need to rethink their operating models, governance and IT ownership structures, said Rob Belk, a cybersecurity consultant with EY.
“This is probably the most interesting cyber topic that doesn’t include the word AI,” Belk said. “And it’s dramatically underreported.”
This shift is being propelled by the changing higher education landscape itself. Traditional funding sources are in flux, creating uncertainty in already highly decentralized ecosystems. University infrastructure is more like a city than a traditional enterprise ecosystems. Each university can include various schools and departments, research institutes, hospitals, athletic facilities, housing, bookstores and even hotels. The population is constantly shifting, with students, faculty, staff, researchers and guests coming and going each year.
The challenge is compounded by the fact that many of these groups may control their own IT environments.
“In many ways, the CIO doesn’t control – sometimes not even most of – the IT that’s out there,” Belk said.
For university CIOs, cyberattacks across these vast and disparate networks are moving faster. Belk noted that attackers’ “speed to compromise” has decreased, shortening the windows to mitigate harm. In 2019, organizations had roughly nine hours to detect and contain an intrusion. Today, that window has compressed to about 48 minutes.
“That’s shockingly fast,” Belk says.
Another risk area for the university is research computing. Historically, research systems have been purchased, operated and maintained by individual schools or principal investigators using grant funding, and many researchers view these systems as personal assets.
CIOs often face opposition to change: “That’s my system. You shouldn’t be having anything to do with it because it’s my research,” Belk said.
But as universities view research as a more explicit revenue stream, CIOs are increasingly responsible for research infrastructure that must be secured like an enterprise system, Belk said.
“The business of research will change,” he said. “And when it does, it will operate more like an enterprise. The security and IT supporting it will have to match that reality.”
Focusing on the Building Blocks of Security
To navigate the complex higher education environment, Belk said CIOs need to focus on the fundamentals.
“Be really great at the basics,” he said. “We see a lot of organizations that still struggle with some of the fundamentals of monitoring their environments, controlling access. And that is something that needs to be addressed. Because if you’re struggling with the basics, you’re leaving yourself open in the first place.”
The cyber basics includes having visibility into your environment, consistent monitoring and patching, and rigorous access control, he said.
According to research from Mandiant, 33% of breaches come from exploits of software flaws, and university internet-facing systems are especially vulnerable, Belk said. Ensuring that all systems are patched “would go a long, long way” in protecting systems and data, he said.
But many recent higher-education hackers didn’t gain access through unpatched systems. They made phone calls and used social engineering to access critical systems, which underscores the importance of identity and access management – and of moving to passwordless systems, Belk said. This challenge is compounded as many university systems manage multiple Active Directories and fragmented IAM systems.
Identity Management Challenges
To simplify and modernize environments, he recommends taking a phased approach, beginning with administrative staff and creating passwordless policies at the enterprise level. The next step is changing the student experience, beginning with the new incoming class, so new identity models become the default over time. Faculty and research staff working with legacy systems would be the last to migrate to passwordless systems.
“I know, by the way, for both of those,” Belk said, “In higher ed that’s easier said than done.”
Belk sees artificial intelligence as an area of opportunity for university CIOs, especially when it comes to addressing staffing shortages and cybersecurity.
Generative and agentic AI technologies can help CIOs address staffing shortages caused by funding constraints in areas like contracting, sourcing, compliance and legal review. “With fewer people, the work doesn’t go away,” he says. “AI becomes a way to close that gap.”
He also advises CIOs to consider partnering with researchers and faculty doing cybersecurity work at their own institutions.
“They’re usually more than willing to want to be able to demonstrate what their research can do, and it gives them and their students the opportunity to try what they’re doing in the real world,” Belk said.