For the last two years, as Cybersecurity Awareness Month returns, I find myself thinking less about firewalls and frameworks and more about people. Technology evolves. Threats evolve faster. But the heart of cybersecurity has always been human. The quiet decisions made every day by educators, administrators, and students determine whether our institutions remain safe or become headlines. And in education, where purpose runs deeper than profit, the stakes feel different. The New Reality of Risk in Education Over the past decade, education has transformed. Hybrid learning, connected devices, digital testing, and research collaboration have all expanded what it means to “protect the classroom.” But with that progress has come complexity, and complexity invites risk. Many schools and universities are now operating with sprawling technology ecosystems managed by small, overstretched teams. These professionals are trying to keep up with relentless change while defending systems that were never designed for today’s threat landscape. I’ve seen firsthand how easily a single vulnerability can cascade into real-world consequences: lost data, canceled classes, disrupted operations, and shaken trust. It’s never just a technical problem, it’s a human one. Awareness Is Not a Checkbox Every October, inboxes fill with reminders about cybersecurity awareness training. But genuine awareness does not come from compliance modules or quiz completions. It comes from culture. It begins when people feel ownership. When they understand why it matters, not just what to do. A district I worked with recently lost its long-time IT director unexpectedly. When the dust settled, leadership realized how much institutional knowledge had lived in one person’s head. It was not about negligence; it was about unseen vulnerability. That moment reminded me that awareness is not about assigning blame. It is about creating clarity. It is the point when leaders say, "We do not have to know everything, but we need to know where we stand." The Leadership Moment Cybersecurity has become a leadership issue, not just an IT issue. It is about creating space for uncomfortable conversations about risk, capacity, funding, and accountability. It is about understanding that every decision, from procurement to password policy, reflects values as much as priorities. The most secure campuses I have seen are not those with the most tools. They are the ones where people talk to each other. Where technology teams, faculty, and administrators work from a place of shared responsibility instead of silos and assumptions. That is not a technical investment. It is a leadership commitment. Awareness That Lasts Beyond October Cybersecurity Awareness Month is a good reminder to pay attention, but awareness can’t be seasonal. The real challenge is how we sustain it through the rest of the year: how we build systems and cultures that make security second nature, not second thought. For leaders in education, that means showing vulnerability. Admitting what we don’t know. Asking for help when we need it. Encouraging the same openness in our teams. It also means balancing mission and protection, ensuring that the drive to connect, innovate, and share knowledge never compromises the safety of those we serve. Closing Thought Cybersecurity is not about locking down learning. It is about preserving it. In every district, college, and university I have worked with, I see the same quiet determination: to keep moving forward despite the noise, the fatigue, and the fear. And that gives me hope. Because awareness is not built by rules or reminders. It is built by leaders who care enough to keep asking hard questions. As we navigate another Cybersecurity Awareness Month, that is where I choose to focus. Not on the threats that surround us, but on the responsibility that unites us.

Higher Education IT professionals must be committed to taking care of others. After all, great IT organizations were never in the business of looking after computing but were always in the business of customer service. It is not about bits, bytes, clouds, anti-virus, border firewalls or even processing credit card payments online. The best IT organizations make it all about people. But we higher ed. IT people find ourselves in the middle of a disrupted industry and this disruption is not going away. In this case, it is not the disruption of GenAI, or data breaches run wild. Instead, it is about survival. The tragic Spring 2025 story of Limestone University in Gaffney, S.C. is yet another in a growing list of institutions no longer able to weather the ominous reality. Founded in 1845, 16 years before the Civil War erupted in Limestone’s home state, Limestone overcame every challenge of a small private institution for some 180 years. That is until April 29 when Limestone’s governing board officially announced its immediate closure. The announcement came after Limestone lost some 50 percent of its enrollment in the past decade, from about 3,200 students to 1,600. A large percentage of these are student athletes as the institution fielded 23 teams at the NCAA Division II level. The closure story is repeated often enough nationally that it sadly runs the risk of no longer being newsworthy. According to federal data provided to The Hechinger Report ( https://hechingerreport.org/tracking-college-closures/ ), 28 higher education institutions closed in the first nine (9) months of 2024 alone. What does this have to do with IT departments? Everything. From an IT perspective, many institutions rely on online learning, video conferencing, worker collaboration suites, CRMs, SaaS ERPs and SIS’, and comprehensive cybersecurity tools at levels that could not have even been dreamed about in the pre-COVID world. That’s not even addressing the emerging AI world, coupled with unfunded mandates from increasingly complex IT compliance requirements. More and more money is needed to attract and retain fewer and fewer potential students at many institutions and that IT budget may look like fertile ground. Not surprisingly, some view IT as a liability – like a very expensive utility bill – as higher education muddles through this dark time. Perhaps a necessary evil, but one that needs to operate as cheaply, as possible. True enough, IT brings significant expense money, and it generates very little direct revenue in most cases. The Good Ole’ Days of IT being directed to “do more with less” is being replaced with “we can do IT without you”. All of which leads back to the higher education IT professional and the mental health impact of this disruption that really dates to the 2008 recession when budgets and staffing levels took a negative turn from which some departments never recovered. Cybersecurity and data privacy professionals are arguably facing the highest stress levels in the organization. The Information Systems Audit and Control Association’s (ISACA) 2024 State of Cybersecurity survey report notes that 66 percent of cybersecurity staff believe their role is more stressful than it was five (5) years ago ( https://www.isaca.org/about-us/newsroom/press-releases/2024/nearly-two-thirds-of-cybersecurity-pros-say-job-stress-is-growing-according-to- new-isaca-research ). Though its focus is on the higher education ecosystem in general, 2025 EDUCAUSE Horizon Action Plan: Mental Health Supports ( https://library.educause.edu/-/media/files/library/2025/1/2025horizonactionplanmentalhealth.pdf ) offers some practical, common sense and sustainable tips for the IT professional, their team, the IT organization, and beyond, to help. Like most things in an IT organization, leadership – or lack thereof – is a key difference maker. A subtle action by a leader to prioritize staff mental health similar to the department’s larger goals of professional development, productivity gains or continuous improvement will make all goals easier to achieve. It is well established that mental health wellness leads to less workplace tension, better employee retention, and less time missed due to illness. But it is also simply the right thing to do because the disruption is disrupting IT employees like never before and it seems like the disruption is here to stay. Bill Balint is the owner of Haven Hill Services LLC, contracted as TriVigil’s Advisory CIO for Education.