Higher education institutions face a cybersecurity reality that most enterprise environments don’t: a massive, constantly-changing user base, a tradition of open access, and IT teams responsible for everything from faculty laptops to research infrastructure. The gaps that result are consistent across institutions of every size. Here are the five we see most often.
1. Over-privileged accounts
Privilege creep is endemic in higher education. Faculty who needed access to a system for one project still have it years later. Administrative staff accumulate permissions across dozens of systems over time. Student workers — sometimes with access to sensitive records — leave at the end of each semester, but their accounts remain active.
Every unnecessary privilege is an opportunity. Attackers who compromise a low-value account with excessive access can pivot to high-value systems without triggering obvious alerts.
Fix: Regular access reviews, automated deprovisioning on separation, and least-privilege enforcement as a design principle, not an afterthought.
2. Unpatched endpoints on unmanaged networks
Universities can’t mandate security configurations on personally-owned devices the way a corporate employer can. Students connect laptops, phones, and other devices to campus networks — and those devices rarely meet enterprise patch standards.
A single unpatched endpoint running vulnerable software can serve as a foothold. Once in, an attacker moves to managed systems.
Fix: Network segmentation that isolates unmanaged devices from sensitive systems. Mandatory patching for any device connecting to administrative or research networks. Zero Trust access controls that enforce device posture before granting access.
3. Shadow IT from departmental tool sprawl
Academic departments make their own technology decisions. A research lab adopts a collaboration tool. An administrative office starts storing files in a personal cloud account. A professor sets up a system to collect student submissions that no one in IT knows exists.
Every unsanctioned tool is a data governance gap and a potential entry point. IT can’t secure systems it doesn’t know about.
Fix: A clear acceptable use policy enforced at the network level. Regular audits of SaaS usage. A procurement process that includes IT review before new tools are adopted.
4. Misconfigured cloud storage
SharePoint permissions set too broadly. An S3 bucket left public during testing and never locked back down. OneDrive sharing settings that allow external access without IT approval.
Cloud misconfigurations are the most common cause of unintentional data exposure — and in higher education, the data being exposed is frequently student PII, financial records, or research data.
Fix: A cloud architecture review that establishes baseline security configurations. Automated monitoring for configuration drift. Clear ownership so someone is accountable when settings change.
5. No incident response plan
Most institutions have a security incident response policy. Far fewer have a tested, current plan — one that specifies who does what in the first 24 hours of a breach, which vendors to call, how to notify affected students under FERPA, and what the chain of command looks like when the president’s office is asking for updates.
Discovering your incident response process during an active breach is the most expensive way to learn it.
Fix: A written, tested IR plan reviewed at least annually. Tabletop exercises that put the plan through realistic scenarios. Clear roles across IT, legal, communications, and leadership.
None of these gaps require exotic solutions. They require expertise, prioritization, and follow-through — applied by people who understand the constraints of higher education environments.
Related reading: 247 Days: Why Breach Dwell Time Is Higher Ed’s Biggest Security Risk and The ROI Case for Cybersecurity Investment in Higher Ed.
Need a practical roadmap? Talk with IT Core about your security architecture.
References: NIST — Cybersecurity Framework 2.0; CIS — CIS Controls v8.
Illustration: Icons8.