Education IT Teams Face Risks From Human and Machine Identities

Schools, colleges and universities face a surge of account creation, device enrollment and third-party app onboarding at the start of each academic year. The rush can lead to misconfigurations and excessive access, while attackers use AI to make phishing messages more convincing.

According to the UK Government’s cyber security breaches survey, 27% of further and higher education institutions reported a breach or attack at least weekly. The figures were 14% for primary schools and 20% for secondary schools. The survey also found that no education tier had a majority of institutions compliant with all 10 of the government’s Cyber Security 10 Steps.

Keeper Security research found that 41% of schools had experienced AI-related cyber incidents, including phishing and misinformation. Meanwhile, 90% of education leaders expressed concern about AI-related cybersecurity threats, and only one in four respondents felt very confident recognizing threats such as deepfakes or AI-driven phishing.

The article, written by Keeper Security’s VP of Global Communications, argues that institutions need to account for non-human identities (NHIs) as well as student and staff accounts. Service accounts, API keys, certificates and AI agents can retain credentials or access that is no longer needed. The author recommends inventorying these identities, reviewing privileges, removing obsolete access and enforcing multifactor authentication across faculty, staff and student accounts.