#United States #Cybersecurity #Mountain View #Higher Education #UpGuard

New Findings Reveal Cybersecurity Risks in Higher Education

A recent report released by UpGuard has raised serious concerns about the cybersecurity landscape in higher education. Titled 2026 Higher Education Third-Party Cyber Risk Report, the report reveals troubling statistics: nearly 28% of the most frequently used vendors by universities have suffered data breaches since 2024. Furthermore, 11% of these vendors are currently battling active infections from infostealer malware—one of the leading causes of credential theft.

As universities are increasingly leaning on complex vendor ecosystems that exhibit rapid growth alongside the integration of artificial intelligence, gaps in security monitoring have arisen. This situation has transformed the third-party risk management landscape, rendering traditional methods of oversight ineffective against the contemporary threats faced.

Key Insights from the Report

The report analyzed data from 515 universities, revealing essential insights into the evolving risk landscape:

• - Vendor Sprawl: As universities expand their digital ecosystems, the reliance on external suppliers continues to grow, with a varied concentration and risk exposure.
• - AI Integration: A staggering 95% of institutions now utilize at least one vendor employing AI technology within their services, increasing the attack surface while complicating security measures.
• - Concentration of Risk: Alarmingly, most institutions rely on a small number of vendors. Approximately 80% share the same 11 vendors (for instance, 97.4% of institutions deploy some Microsoft products), meaning that a breach within a single supplier could pose widespread repercussions across the sector.
• - Underrated Vendors Carry Risks: Even vendors used by a limited number of institutions can harbor significant risks. About 67% of vendors are only utilized by five or fewer universities, but their involvement in critical operations still requires urgent attention to prevent data mishandling.

Recommendations for Enhancing Security

In light of these findings, UpGuard emphasizes that universities must take immediate measures to mitigate risks:
1. Maintain an Updated Vendor Inventory: It is crucial for institutions to create and manage a dynamic inventory reflecting the risk levels, usage, and AI exposure of their vendors to ensure ongoing assessments are accurate and timely.
2. Identify and Manage Concentration Risks: Recognizing key vendors that pose significant risks across the university ecosystem is essential. Assess these dependencies with proper ownership and response plans to minimize repercussions from breaches.
3. Adjust Risk Assessment Approaches: Assess vendors based on their risk and the nature of data they manage, rather than solely on their prevalence. This will help prioritize attention to those that manage sensitive data beyond the more frequently-utilized suppliers.
4. Adopt Continuous Monitoring Practices: Transitioning from point-in-time evaluations to continuous monitoring will help institutions stay abreast of changes in vendor risks, including breaches, critical vulnerabilities, and other security posture shifts.

Call to Action

As the summer period presents a quieter time for many institutions, it is the opportune moment for security teams to reevaluate their vendor relations. Greg Pollock, UpGuard's Director of Research and Insights, indicates that proactive measures by universities will position them favorably to withstand potential breaches.

For a deeper dive into the report and its findings, interested parties can access the complete document on UpGuard’s official website. Additionally, a webinar titled "Beyond the Findings: A Practical Playbook for Higher Education Vendor Risk" is scheduled for July 23 at 1:00 PM PDT, offering practical strategies for managing vendor risk in an educational context. Knowledge shared in this session promises to equip attendees with effective tools for navigating the complexities of third-party risks in their environments.

About UpGuard
Founded in 2012, UpGuard has established itself as a vibrant leader in cybersecurity and risk management. Its platform, powered by AI for Cyber Risk Posture Management, provides organizations with a detailed view of their cybersecurity landscape concerning vendors and overall exposure. For more information, visit UpGuard.