Higher ed isn’t ready for AI-scale cyberattacks

Higher education institutions have long understood the theoretical risks of cyberattacks. What many leaders are only now beginning to confront is the operational scale of disruption that modern attacks can create.

The recent ransomware attack affecting Canvas forced colleges and universities across the country to delay exams, pause coursework, and communicate with students through backup channels during finals week. And Canvas is hardly alone. Institutions continue to face ransomware attacks, data breaches, and third-party vendor compromises that disrupt instruction, research, payroll, housing, and other core operations.

At the same time, cyberattacks are becoming faster and more sophisticated. AI-enabled phishing campaigns, automated vulnerability scanning, and increasingly coordinated ransomware operations are lowering the barrier for attackers while increasing the pressure on institutions. Higher education’s decentralized operating models and complex technology ecosystems make colleges and universities particularly vulnerable.

Cyber incidents are not simply IT events; they can quickly become enterprise-wide crises.

Cyber crisis response requires cabinet-level coordination

Whether leaders ultimately decide to pay a ransom or refuse, the larger issue is that institutions often underestimate how complex those decisions become in real time.

A serious cyberattack immediately becomes a leadership coordination challenge. While IT teams work to assess system damage and restore operations, senior leaders must simultaneously manage institutional continuity, communications, legal exposure, governance, and public trust.

In practice, that means rapid coordination across three critical areas:

Putting emergency response plans into practice

Many colleges and universities have incident response plans on paper. Far fewer have practiced making these decisions collaboratively under realistic conditions. Institutions often struggle not because leaders disagree on goals, but because decentralized structures and unclear decision-making processes slow coordinated action during moments of stress. And cyber crises quickly expose those vulnerabilities.

Tabletop exercises help colleges and universities move beyond theoretical planning and pressure-test how leaders would actually coordinate during a major disruption. They also reveal operational dependencies that leaders did not fully appreciate beforehand.

EAB supports institutions in preparing leadership teams for enterprise-level crisis response in two ways:

1. Resource center for security incident preparedness

EAB’s IT Strategy Advisory Services partners can access our Security Incident Response Tabletop Exercise Resource Center to prepare for security threats. The resource center provides tools, templates, and facilitation guidance institutions can use to practice coordinated emergency and cyber response planning across campus leadership teams.

2. Live tabletop exercises for IT and cabinet leaders

EAB also facilitates live tabletop exercises tailored to college and university leadership teams.

Depending on institutional needs, exercises can focus on:

• IT and information security response teams
• Cabinet and executive leadership teams managing enterprise-wide crisis decisions

These facilitated sessions simulate the operational, reputational, and governance pressures institutions face during a significant cyberattack. Participants work through realistic scenarios in real time, helping institutions identify gaps in communication, escalation protocols, and decision-making before a real incident occurs.

Availability for live tabletop exercises is limited. To schedule a facilitated tabletop exercise for your team, reach out to [email protected] or your Strategic Leader today.

Ann Forman Lippens

Managing Director, Research

Read Bio

• Ann Forman Lippens's LinkedIn page