Why education IT teams must protect both human and machine identities

At the start of every school year, schools, colleges and universities across the UK race to onboard thousands of new students, faculty and staff members, provisioning accounts, issuing credentials and connecting a wave of new devices to institutional networks.

That operational pressure creates opportunities for attackers, and this year, AI is amplifying the threat more than ever.

Not only are phishing campaigns more convincing, but a hidden layer of unmanaged machine identities is expanding the cyber attack surface.

Attackers are persistent and the education sector remains a top target with many facing cyber attacks weekly.

The UK Government’s cyber security breaches survey revealed that 27% of further and higher education institutions reported experiencing a breach or attack at least weekly, compared to 14% of primary schools and 20% of secondary schools.

Navigating the expanded threat window The education sector is one of the highest targeted industries for ransomware, credential theft and data breaches.

For hackers, schools and universities present an appealing combination of high-value data, including student records, financial information and research, alongside underfunded IT departments and an enormous, ever-rotating user base.

The back-to-school season intensifies this pressure.

Bulk account creation, mass device enrolment and a surge of third-party application onboarding all happen simultaneously, creating a greater risk of misconfiguration and excessive access rights.

The UK Government found that no tier of the education sector had a majority of institutions compliant with all of the government’s Cyber Security 10 Steps.

Just 14% of primary schools, 23% of secondary schools, 33% of further education colleges and 45% of higher education institutions had covered all 10.

As thousands of new identities and devices enter this already insecure environment, gaps in security controls can become harder to identify and manage.

AI has made cybersecurity threats significantly more dangerous.

The same government survey found phishing to be the main threat identified by institutions that had suffered a breach, and those emails can now precisely mimic communications from student funding offices, IT helpdesks or university leadership, with none of the traditional red flags that once made them easy to spot.