Zero Trust without Zero Productivity: Adaptive Security for the Open Campus

Universities occupy a unique position in cybersecurity: they must protect institutional data, research assets, and student records while preserving the openness that makes a campus work. Thousands of personal devices connect daily, guest researchers need immediate access, and academic culture resists restrictive controls. Traditional perimeter-based security was not designed for this environment. Most institutions have made progress on identity—MFA and SSO are widely deployed—but at the device layer, significant gaps remain. An unpatched laptop can still access the same systems as a fully compliant, managed device. This session offers a practical maturity model for endpoint security in higher education: building device visibility, enforcing risk-tiered compliance, automating routine remediation, and implementing continuous posture assessment. At each stage, we address both the technical implementation and the management challenges that determine whether policies get adopted or resisted. We give particular attention to designing security that works within shared governance—policies faculty and students will accept, communication strategies that reduce friction, and pilot approaches that build momentum. Attendees will use a self-assessment rubric during the session to evaluate their current posture and will leave with a phased roadmap template for their institution.