Higher education is facing an intensifying wave of cyberthreats, driven primarily by ransomware attacks and data breaches. The United States alone accounts for 33% of the 104 education-sector attacks recorded worldwide, more attacks than any other country with an uptick in attacks on higher education specifically.
The rapid adoption of AI tools across campuses adds to those risks, as sensitive data can be exposed through something as routine as entering information into a browser-based AI tool.
For campus IT and security teams, protecting systems and sensitive data requires an approach that accounts for both external attacks and the risks associated with legitimate users. That means preparing to contain threats when defenses fail while also maintaining the open, collaborative environments that colleges and universities depend on.
Attackers don’t necessarily need sophisticated zero-day exploits to gain access to campus systems. Instead, they often exploit known vulnerabilities — including broken authentication, exposed APIs, phishing, and credential theft — that decentralized campus environments make easy to miss.
Everyday AI use adds another layer of risk. Without appropriate controls, faculty, staff, and students who use browser-based AI tools may unintentionally upload sensitive research, student records, or other protected information to external services, creating potential security and compliance risks.
Over the past several months, incidents across colleges, K–12 schools, and the platforms they rely on have shown how disruptive and costly a successful breach can become:
Community College of Beaver County (PA), March 2026: A ransomware attack encrypted college data and disrupted access to academic and administrative systems, resulting in canceled classes and campus closures.
Springfield Public Schools (MA), September 2026: A cyberattack forced one of the largest school systems in Massachusetts, serving more than 23,000 students, to cancel classes after access to critical services, including students’ medical records, was disrupted.
Canvas/Instructure breach, May 2026: Attackers gained access to the widely used learning management platform, exposing student and staff information and disrupting access for educational institutions.
In an environment that is lacking layered security provisions, an attack that starts with one compromised machine can eventually disrupt operations across campus.
Microsegmentation is built to close this gap. Rather than trying to prevent every possible intrusion, Zero Trust microsegmentation operates on the assumption that a breach will occur and limits an attacker’s ability to move between connected systems. Modern microsegmentation solutions like Akamai Guardicore Segmentation use software-based policies to control communication between workloads and processes across on-premises, cloud, and hybrid environments without requiring a redesign of existing infrastructure.
The same “assume breach” thinking applies to access. Many institutions still rely on flat, VPN-based access that can expose more of the network than an individual user needs. With Zero Trust Network Access, however, students, faculty, contractors, and partner institutions can only connect to authorized applications. If a credential is compromised in this environment, these restrictions limit how far attackers can go.
This security mindset extends naturally to AI. Secure enterprise browser technology gives IT teams visibility into AI interactions, including prompts and file uploads, and allows them to apply data loss prevention (DLP) policies to prevent sensitive data from being shared with external services.
These controls become increasingly important as institutions adopt custom AI applications and integrations that exchange data through APIs. Security teams must account for both the information users enter into AI tools and the data that AI-enabled applications access, process, and share.
We bring together microsegmentation, Zero Trust application access, API security, and AI usage control to help higher education institutions protect distributed environments, limit the impact of cyberattacks, and govern access to sensitive data.
These capabilities help:
Contain threats like ransomware with workload-to-workload policy enforcement that restricts lateral movement and helps prevent ransomware from spreading across the network
Control AI usage by limiting the sensitive information that users can share with AI tools while allowing students and faculty to continue using them for legitimate academic work
Address broken access control, the leading OWASP Top 10 vulnerability, by replacing broad network exposure with least-privilege access to only the applications and data that a user requires
Provide protection against API vulnerabilities, including authorization weaknesses
Support compliance requirements, including the Family Educational Rights and Privacy Act (FERPA) and other mandates, through access restrictions, segmentation policies, and AI governance controls that are built from the ground up on Zero Trust principles
Strengthen cyber insurance readiness with documented security controls that carriers increasingly require before writing or renewing a policy
As campus environments become more interconnected and AI adoption continues to expand, higher education institutions need security controls that can adapt alongside them. An “assume breach” approach helps security teams prioritize containment, enforce appropriate access, and protect sensitive information while keeping academic and administrative systems available to the people who depend on them.
As educational institutions adopt agentic AI tools and custom large language model (LLM) integrations for academic research and campus administration, security teams face a dual challenge: protecting AI model endpoints from adversarial API abuse while governing the sensitive datasets feeding retrieval-augmented generation (RAG) pipelines.
We provide unified visibility across both agentic API traffic and end-user browser sessions, ensuring that enterprise AI adoption never compromises data governance or campus operational resilience.
Contact us to learn how we can help your institution strengthen its security posture and protect critical campus systems.
© 2026 Akamai Technologies
