Cybersecurity Is Not an IT Problem: Reframing Risk, Governance, and Accountability in Higher Education

Cybersecurity incidents in higher education rarely result from missing tools or controls; they fail because cyber risk is still treated as a technical issue rather than an institutional one. When cybersecurity is isolated within IT, executive and board decisions are often made without a clear understanding of the academic, financial, regulatory, and reputational impacts.This session reframes cybersecurity as an institutional risk management challenge. Drawing on real-world examples from higher education, the presenter will examine why traditional cybersecurity reporting fails to influence leadership decisions, how cyber risk becomes disconnected from enterprise risk management, and why federal expectations and cyber insurance requirements are accelerating the need for change. Attendees will leave with practical approaches to reposition cybersecurity conversations at the institutional level, where strategic decisions, risk acceptance, and accountability truly belong.