From Exposure to Exploitation: Measuring Cyber Risk Dynamics in Higher Education

Our ongoing research of the cyberthreat intelligence (CTI) ecosystem is one of the most comprehensive analyses of accessible global CTI data from over 50 providers spanning 2.5 years. In 2025, these providers produced over 2 trillion threat contexts. These described threat actors, their tactics, techniques and procedures (TTPs), and related indicators of compromise (IOCs), offering an incredible view into the breadth of threat vectors of attackers as well as threat exposes of defending organizations. We will focus this CTI lens on the education sector to reveal sobering statistics of cyberthreat risk for institutions of higher learning: 100% of the campus networks of the top 50 U.S. universities exhibit breach activity. Our analysis will include a breakdown of CTI into 10 supercategories, from malware and phishing to defensive evasion and attempted 0-day execution attributed to observed malicious activity originating from or tunneling through campus networks. We will examine risk-weighted vulnerabilities of exposed and breached network assets and the clustering of universities into risk groups based on observed threat intelligence. We will report on patterns in “shadow infrastructure” that have been commandeered for specific malicious purposes, as well as on a time-series analysis of the “weaponization lag” and “remediation lag” of such breaches. These insights can be a leap toward an improved, proactive cyber defense for university organizations.