As cyberthreats grow more sophisticated, universities must safeguard students, staff and critical research without compromising openness or innovation. We asked Mark Molyneux, Field CTO – Northern Europe at Commvault; Naz Bozdemir, Lead Product Researcher, HackerOne and Mat Pullen, Director for Education at Jamf, how universities can build a resilient cybersecurity strategy that protects students, staff and research while supporting open access and Digital Transformation.
Mark Molyneux, Field CTO – Northern Europe at Commvault
Universities manage vast volumes of sensitive data – from student records and payroll to pioneering research – while maintaining open networks that enable collaboration for remote learning and digital innovation. Building a resilient cybersecurity strategy therefore requires an integrated approach that protects identity, data and core systems without limiting student access or hampering Digital Transformation.
A growing threat to higher education (HE) is the rise of identity-based attacks, with the Cyber Security Breaches Survey 2025 revealing that of the HE institutions that faced a cyberattack last year, 97% of those suffered phishing attacks and 68% saw cybercriminals impersonating their staff or organisation. Rather than forcing entry, attackers compromise identity platforms such as Active Directory and move undetected using legitimate credentials. Protecting identity systems must therefore be a foundational priority, with continuous monitoring, anomaly detection and automated rollback of suspicious changes to prevent widespread disruption.
Equally, resilience must extend beyond traditional backups. Attackers increasingly target backup repositories or deploy dormant ransomware that activates after restoration. Universities need clean recovery environments where data, identity services and critical applications can be restored and tested in isolation before being brought back online. Automation and AI-driven threat detection can significantly reduce recovery times, ensuring that services resume safely and swiftly.
Ultimately, regular testing, cross-team collaboration between security and IT operations and clear incident response planning are necessary to enable HE institutions to maintain trust while continuing to innovate. By aligning security, identity and recovery into a unified resilience strategy, universities can safeguard their communities and research assets while confidently advancing their digital ambitions.
Naz Bozdemir, Lead Product Researcher, HackerOne
A recent MI5 briefing warned that UK university leaders are increasingly attractive targets for foreign states and hostile actors: an urgent reminder that higher education now sits squarely in the crosshairs of geopolitical cyber-risk.
Universities are being urged to review their defences and improve their cyber-resilience as quickly as possible. However, this is easier said than done. Universities are challenged with protecting a constantly evolving and expanding digital environment with countless connected assets and limited staff.
Structured vulnerability disclosure and bug bounty programmes provide a scalable way to surface real-world weaknesses before adversaries can exploit them. The model enables lean security teams to tap into the power of a community to scale their reach, meaning they can innovate and expand digital services with confidence. Fortunately, 71% of educational institutions already use bug bounty programmes to uncover unknown vulnerabilities, with continuous validation helping protect student data and safeguard sensitive research.
Santa Clara University in the US has taken this further by launching a student-driven bug bounty initiative, which has extended the reach of its security team while embedding real-world cybersecurity experience into the academic environment. The initiative has improved how the security team monitors their digital environment, particularly across less-visible assets like research servers and departmental cloud instances. As skills shortages continue to challenge the cybersecurity sector, universities are uniquely positioned to strengthen their own resilience while cultivating the next generation of cybersecurity professionals, turning education into a strategic security advantage.
Mat Pullen, Director for Education at Jamf
Implementing measures that build cybersecurity resilience in universities can be more challenging than at other educational levels. When you consider university as a stepping stone between education and a career, it’s crucial that these skills are taught to prepare students with the digital capabilities they’ll rely on in the future, while also strengthening the university’s overall resilience.
Today’s university students have grown up with the Internet and technology, where smart devices and high-speed connectivity are a normal part of life. This makes them curious, trusting and confident online, but it can also leave them naive about digital risks. Without strong safeguards, they may encounter harmful content and threats such as malware and phishing.
Technology plays a vital role in creating a safe online experience in education. While students in further education should have the freedom to explore and grow, content-filtering tools can help ensure they do so safely. This creates a safety net against malicious content while still allowing students to explore and learn independently.
At the same time, maintaining human connection is essential, supporting students to understand online risks and why they matter. Lecturers and students should receive resources and training on using new technology safely and effectively in education. This ensures students are prepared for a technology-driven world and can use these tools responsibly and productively.
It’s important that joint responsibility is emphasised, which could be integrated into mandatory tutoring programmes across all subject areas. Smaller groups would allow students and staff to discuss the topic in greater depth, adding more value to the conversation. Without this understanding, driving change on such a scale is nearly impossible.
