WEBINAR @ 13th May, 2 PM (GMT+1)
What's Stopping Progress in Higher Education?
Register now
Higher education institutions are complex, open and data-rich. A single university has to support applicants, students, faculty, researchers, alumni, agents, partners and a long list of third-party systems, often across multiple campuses and multiple countries. That openness is a strength. It is also part of why universities are attractive targets.
Cybersecurity training matters because many incidents start with an ordinary human action: clicking a link in a convincing email, approving an unexpected login request, reusing a password, sharing a document through the wrong channel, misdirecting an email that contains applicant data, or trusting a fraudulent invoice. None of these are exotic. They are the everyday moments where risk and normal work overlap.
The wrong response is to conclude that people are the problem. The better framing is that people are part of the institution's defence. Good cybersecurity training helps staff, students and researchers recognise risk, make safer decisions, and report concerns quickly. It does not solve cybersecurity on its own, and it is not a compliance checkbox. It is one component of institutional resilience, and it only works when it is designed with the same care as any other part of the security programme.
This article sets out eight practical tips for building an effective cybersecurity training strategy in higher education. It is written for the people responsible for it in practice: CIOs, CISOs and IT directors, data protection officers, admissions and enrolment leaders, registrars, student services, finance, HR and onboarding teams, academic and research leaders, and the professional services staff who keep institutions running. Where relevant, it also considers students as users.
Higher education is a distinct risk environment, and generic security advice rarely fits it well.
Universities hold some of the most sensitive and longest-lived personal data of any sector. A single applicant record can contain identification documents, academic transcripts, financial information, references, health or wellbeing declarations, fee status evidence, sponsorship details and a full communications history. That data does not disappear once a decision is made. It carries through enrolment, through years of study, into graduation and into the alumni relationship. Alongside personal data, institutions hold research data and intellectual property, payment and finance data, staff and HR records, and privileged access to core systems.
Several structural features make this harder to protect than in many other sectors:
The sector is a deliberate target rather than an accidental one. The UK's National Cyber Security Centre, in guidance written with Universities UK, Jisc and UCISA, notes that the open and collaborative approach central to universities also makes their data and research valuable to attackers. Jisc's annual cyber threat intelligence reporting for the UK tertiary sector describes a picture of fewer headline incidents but greater sophistication: Jisc reported seven major incidents across higher education, further education and research in 2025, down from 17 in 2024, even as the total number of recorded incidents rose from over 11,000 to more than 16,000. Jisc also reported growing professionalism and state sponsorship in cybercrime, and increasing use of artificial intelligence by attackers, with higher education providers as the primary targets. The same reporting found that most higher education providers now have dedicated cybersecurity staffing, a reflection of how seriously the sector treats the risk.
At a broader level, the UK Government's Cyber Security Breaches Survey 2025/2026 found that almost every higher education institution in its education sample, 98%, had identified a breach or attack in the previous 12 months. Among further and higher education institutions that identified a breach, phishing was reported by 96%, while 27% of further and higher education institutions reported breaches or attacks at least weekly. The survey also found that 49% of higher education institutions held personal data on employees or students that was not protected by techniques such as anonymisation or encryption. These figures reinforce the point that training must be connected to identity, phishing, data handling and technical controls.
The point of these figures is not to alarm. It is to make one thing clear. Cybersecurity training in higher education is part of resilience, not a standalone solution. Training reduces the likelihood that a routine mistake becomes an incident, and it speeds up detection when something does go wrong. It cannot replace technical controls, and it should never be asked to.
These three words are often used interchangeably, which weakens both planning and measurement. It helps to separate them, in line with the way bodies such as NIST and EDUCAUSE frame the distinction.
Higher education needs all three. Everyone needs baseline awareness. Specific teams need role-based training tied to the data and systems they actually handle. A smaller group needs genuine education because they design, configure or own the systems that everyone else depends on. A strategy that only delivers one of these, usually a single annual awareness module, will leave predictable gaps.
Before the tips, it is worth naming the core topics a rounded programme should address. The eight tips that follow are about how to deliver training well; this is a short checklist of what belongs in scope:
The list is deliberately not exhaustive, and no single session should attempt all of it. The tips below explain how to turn this scope into training that changes behaviour.
Training should reflect the institution's real risks, systems and data, not a generic template bought off the shelf. If the programme is designed only to satisfy an audit, it will teach people to complete a module rather than to behave more safely.
Start from evidence. Map the institution's key risks by audience, using your own incident and near-miss data alongside sector threat intelligence from sources such as Jisc and the NCSC. Prioritise the areas where higher education is repeatedly hit: phishing and identity attacks, mishandling of personal data, payment and invoice fraud, and research data exposure. Align the content with the institution's stated risk appetite, and involve the people who own the risk: IT and security, the data protection officer, legal, HR, academic leadership and operations.
Avoid the common failure modes. A single annual module that everyone rushes through teaches almost nothing durable. Compliance-only content encourages box-ticking. And treating completion as the only measure of success tells you that people watched a video, not that they can spot a fake login page.
Different groups face different threats and hold different data, so one-size-fits-all training wastes everyone's time and misses the highest-risk cases.
Design for the audiences that actually exist in a university: all staff as a baseline; then faculty, students, researchers, admissions and enrolment teams, marketing and recruitment, student services, finance, HR, IT administrators, system owners, senior leaders, and external agents or partners where relevant. Within that, identify the higher-risk groups and give them more:
Match the depth to the role. Do not overwhelm non-technical staff with technical detail they cannot act on, and do not give privileged users the same light-touch content as a general user whose account carries far less risk.
Phishing, social engineering, credential theft and MFA fatigue remain central to how attackers get in, and higher education is no exception.
The evidence is consistent. The Verizon 2025 Data Breach Investigations Report found that credential abuse and exploitation of vulnerabilities continued to be leading initial attack vectors, at 22% and 20% respectively, and that human involvement in breaches remained high. The ENISA Threat Landscape 2025 identified phishing as the leading method for initial intrusion, in around 60% of observed cases, and noted the rise of phishing-as-a-service, information-stealing malware that harvests credentials at scale, and newer techniques such as QR-code phishing (sometimes called quishing).
Cover the threats people will actually meet: phishing emails, fake login pages, malicious QR codes, fraudulent invoices, fake meeting or calendar invitations, impersonation of colleagues and leaders, MFA fatigue and prompt bombing, and session hijacking. Then give people something to do about it:
On MFA, the NCSC is clear that not all types of MFA are created equal. Attackers have learned to defeat weaker methods through social engineering, so the NCSC recommends phishing-resistant approaches such as FIDO2 and passkeys where practical, and warns against MFA anti-patterns that create fatigue.
What to avoid is just as important. Do not blame people who click, and do not measure success by click rate alone; reporting behaviour is the more useful signal. Over-obvious simulations that feel like entrapment erode trust and discourage the reporting you are trying to build.
Cybersecurity training is far more effective when it is connected to the specific data a person works with every day. Abstract data protection modules do not stick; concrete examples do.
Higher education generates an unusually wide range of sensitive data: applicant records and identity documents, references, disability and wellbeing information, visa and immigration documents, student records, payment and scholarship information, research data, alumni data and staff records. Build role-specific examples around these. An admissions officer should learn how to handle applicant documents and identity data safely; a finance team member should learn how to verify a change of bank details; a researcher should learn how to store and share controlled data.
Practical actions include teaching data classification so people can recognise what counts as sensitive, showing how to share information securely, explaining retention and deletion so data is not kept forever by habit, and being explicit about which systems are approved for which data. Connect all of this to institutional policy and to the institution's GDPR obligations.
Avoid the traps: do not assume everyone already knows what sensitive data looks like, and do not tolerate the use of unapproved file-sharing services or public AI tools for student and applicant data. Much of this ground is covered in depth in Full Fabric's guide to student data privacy and FERPA compliance, which is a useful companion for teams designing role-based data handling training.
Training cannot be a once-a-year event that people forget within a fortnight. It works best when it is embedded into the moments where risk is highest and attention is naturally available.
There are many such moments in a university calendar:
Deliver against those moments with short refreshers, just-in-time reminders, seasonal campaigns and role-specific microlearning, rather than relying only on an annual mandatory module. Update onboarding so that new staff and students learn safe behaviour from day one. And when someone does slip, use a short, supportive refresher rather than a reprimand.
Avoid the familiar failures: long modules that people click through as fast as possible, and content that is repeated unchanged year after year while the threats move on.
Fast reporting reduces harm. If someone reports a suspicious email within minutes, the security team can often act before the damage spreads. That only happens if people know what to report and feel safe reporting it.
Be specific about what to report: suspicious emails, unexpected MFA prompts, misdirected emails, lost or stolen devices, accidental data sharing, unusual account behaviour, suspected invoice fraud, fake websites or social profiles, and unusual requests from suppliers or partners. Then make reporting easy and rewarding:
The culture point is decisive. Shaming staff or students, hiding incidents, making reporting difficult, or treating a near miss as a failure rather than a learning opportunity will all quietly train people to stay silent. A no-blame culture is not softness; it is the mechanism that turns your entire workforce into an early-warning system.
Training works best when people are supported by systems that make safe behaviour the easy behaviour. Asking staff to compensate for weak controls through vigilance alone is unfair and unreliable.
The controls and processes that training should sit alongside include single sign-on and MFA, role-based access and least privilege, audit logging, patching and secure configuration, backups, secure email gateways, endpoint protection, approved file-sharing, data retention, incident response plans, supplier due diligence, regular access reviews, and proper offboarding. The NCSC also offers UK institutions services such as Early Warning, while Mail Check and Web Check were retired on 31 March 2026. Institutions should use current NCSC guidance and, where appropriate, DNS Check or external attack surface management tools to complement training by strengthening the technical layer.
Training should explain how these controls work and what the user's part is, for example why an MFA prompt matters or why exports are restricted. But the controls themselves must not depend on perfect human behaviour. This is where the choice of core platforms matters. Systems that manage student lifecycle data should support role-based access, auditability, GDPR-aligned workflows and secure integrations by design, so that the safe path is also the default path. Full Fabric's security and GDPR page makes this argument directly: for a platform holding applicant and student data, security is an architectural question rather than a feature bolted on afterwards.
Two things to avoid: implying that training can make up for controls the institution has not implemented, and building controls so awkward that staff invent workarounds. Workarounds, such as exporting data to personal spreadsheets, are often where the real risk lives.
Completion tells you that people opened a module. It does not tell you whether they can recognise a threat or respond well. Effective programmes measure behaviour and outcomes, while being honest about the limits of the data.
Useful measures may include completion rates as a baseline, phishing reporting rates, the time it takes to report a suspicious email, repeat risky behaviour, MFA adoption, password manager adoption where it is tracked, the number of reported suspicious emails, data-handling incidents, access-review completion, training feedback, tabletop exercise outcomes, and audit findings. Where it can be measured credibly, a reduction in preventable incidents is the outcome that matters most.
Handle metrics with care. Do not invent benchmarks, and do not import a click-rate or completion target from a vendor deck and present it as a universal standard. Click rates can be useful, but treating them as the headline measure can be misleading because simulations vary widely and do not capture whether people report quickly, handle real incidents well, or change behaviour over time. Reporting rate and reporting speed are usually better indicators of a healthy security culture.
In practice: build a simple dashboard, review metrics by role and risk rather than as a single institution-wide average, connect findings to real incident themes, and report to leadership in the language of risk. Avoid celebrating full completion while incidents continue, or punishing individuals on the basis of a simulation result.
The following table is a starting point for planning role-based content. Adapt it to the institution's own structure, systems and risk profile.
| Audience | Key risks | Training focus | Frequency or timing |
|---|---|---|---|
| All staff | Phishing, weak credentials, misdirected email, unapproved tools | Awareness, phishing recognition, reporting, MFA, acceptable use | Onboarding, then short refreshers through the year |
| Students | Phishing, account takeover, scholarship and payment scams, oversharing | Awareness, phishing, safe account and device habits, reporting | Induction, then seasonal reminders |
| Faculty | Phishing, research data exposure, student data handling | Data handling, secure sharing, phishing, approved tools | Onboarding, plus updates when policies or systems change |
| Admissions and enrolment teams | Applicant document handling, identity data, agent communications | Data classification, secure sharing, phishing, GDPR basics | Onboarding, plus a refresh before peak season |
| Finance teams | Invoice fraud, business email compromise, payment changes | Payment verification, out-of-band checks, BEC recognition | Onboarding, plus refreshers before deposit deadlines |
| Researchers | Sensitive and controlled data, IP theft, targeted phishing | Data governance, secure storage, travel and fieldwork security | Onboarding, plus before travel or new projects |
| Student services | Wellbeing and special category data, safeguarding | Handling sensitive data, secure communication, reporting | Onboarding, plus periodic refreshers |
| IT administrators | Privileged access, targeted attacks, misconfiguration | Deeper security education, privileged access, secure configuration | Onboarding, plus ongoing role-based education |
| Senior leaders | Impersonation, business email compromise, high-value targeting | Executive-focused threats, verification habits, reporting | Onboarding, plus tailored briefings |
| External agents or partners | Data handling outside the institution, phishing | Expectations, secure sharing, reporting routes | At contracting, plus periodic reminders |
Programmes tend to fail for a recognisable set of reasons. Checking against this list is a quick way to find weak points:
For institutions in the UK and EU, or those processing the data of people based there, cybersecurity training supports data protection by helping staff understand how to handle personal data safely. It is one of the organisational measures that sit alongside technical measures under the UK GDPR and EU GDPR frameworks.
Training in this area should help people understand student and applicant personal data and how it should be handled; the special care needed for special category data such as health and wellbeing information; the principle of data minimisation; secure sharing and access control; retention and deletion; how to recognise and report a personal data breach quickly; the rights of data subjects, including access, rectification and erasure; what to do about accidental disclosure; which tools are approved for personal data; and when and how to involve the data protection officer.
Two cautions matter here. First, this is not legal advice, and training content should not be presented as a definitive interpretation of the law; institutions should work with their DPO and legal teams. Second, and more importantly, training does not equal GDPR compliance. Compliance is the outcome of governance, policies, lawful bases, technical controls and accountable processes, applied consistently. Training helps people operate those controls correctly, but it cannot substitute for them. Full Fabric's own security and GDPR material is explicit on this point: software and training support compliance, but compliance itself remains the institution's responsibility.
AI is changing how some attacks are delivered, and training content needs to keep up without tipping into hype.
The credible signal is clear enough. The ENISA Threat Landscape 2025 reports that AI is now widely used to make phishing more convincing: AI-supported phishing campaigns reportedly represented more than 80% of observed social engineering activity in one recent period, and the report describes the emergence of purpose-built malicious AI tools designed to automate social engineering. AI-assisted impersonation, including synthetic voice and sometimes video, is a growing concern for targeted fraud, and it connects directly to business email compromise and to fraudulent job, scholarship or payment communications aimed at applicants and students.
Practical training responses do not require deep technical knowledge:
Keep the emphasis proportionate. Deepfakes attract headlines, but for most institutions the dominant risks remain phishing, credential theft and payment fraud, now sometimes sharpened by AI. Full Fabric's guide to navigating AI in higher education and its contextual AI approach both stress governed, human-overseen use of AI, which is the same principle training should reinforce with staff.
Full Fabric is not a cybersecurity training platform, and nothing in this article should be read as suggesting otherwise. But platforms that manage student lifecycle data play a real part in reducing cyber and data governance risk, because they shape where sensitive data lives and how it is accessed.
Full Fabric is a purpose-built higher education platform that brings CRM, admissions, enrolment, payments, student records and reporting onto one connected record per person, from first enquiry through to alumni status. That unified model has practical security and governance implications: it supports role-based access and permissions that reflect the actual structure of an institution; it supports auditability of who accessed or changed a record; it supports GDPR-aligned workflows such as consent tracking, retention and archival, and subject access request handling; and it supports integrations with existing systems, so data flows are defined and reviewable rather than ad hoc.
The governance benefit is often about what a connected platform removes. Fragmented tools, uncontrolled exports and duplicated records create exactly the risky workarounds that training tries to discourage. Reducing spreadsheet sprawl and parallel copies of the student record shrinks the surface area where data can leak, which for IT and data protection teams means fewer places to secure, audit and govern. Institutions can review the specifics through Full Fabric's security and GDPR page and its Trust Center, and teams responsible for the technology estate may find the software for IT teams overview useful.
It is important to be transparent about the limits. Full Fabric does not replace cybersecurity training. It does not replace identity providers, endpoint protection, SIEM, backup, learning management systems, ERP, finance systems or dedicated security tooling. Institutions still need policies, training, incident response, vendor due diligence and security operations. And security depends on how any platform is configured and used, not on the platform alone. The role of a well-designed higher education CRM platform is to make governed behaviour the default, so that good training has good systems to work with.
A focused first quarter can move an institution from a generic annual module to a risk-based, role-based programme. The phases below are a template to adapt, not a rigid plan.
A short set of questions can quickly reveal how mature a cybersecurity training programme really is:
Cybersecurity training in higher education works when it is risk-based, role-based, continuous and connected to the real systems and data that people use. It fails when it is generic, annual, blame-based and measured only by completion. The strongest institutions do not treat training as a checkbox. They build a culture where people understand the risks, know what to do, and report quickly when something looks wrong, supported by controls that make safe behaviour the default.
Training remains essential, and it must sit alongside MFA, single sign-on, access control, patching, monitoring, secure configuration, backups, incident response, vendor due diligence and sound data governance. For institutions managing sensitive student lifecycle data, Full Fabric provides a purpose-built higher education platform with security, GDPR and data governance capabilities that support safer admissions and student record operations. Secure platforms and clear governance do not remove the need for training. They make safer behaviour easier, which is exactly what good training is trying to achieve.
Cybersecurity training in higher education is the structured effort to help staff, students, researchers and partners recognise cyber risks, respond safely to them, and report concerns quickly. In a university context it usually combines broad awareness for everyone, role-based training for teams that handle sensitive data or systems, and deeper education for people with security responsibilities such as IT administrators and data protection staff. It is one part of a wider security programme, not a replacement for technical controls.
Universities hold large volumes of sensitive and long-lived data, operate open and decentralised environments, and are deliberate targets for attackers. Sector reporting from Jisc and others shows continued targeting of higher education, with attacks becoming more sophisticated and increasingly AI-assisted. Because many incidents begin with an everyday human action such as clicking a link or approving a login prompt, training that helps people make safer decisions and report quickly can materially reduce the likelihood and impact of incidents.
At a minimum, it should cover phishing and social engineering, good credential practice and password managers, MFA and MFA fatigue, safe handling of the data each role works with, secure file sharing, use of approved versus unapproved tools including AI tools, and how to report suspicious activity. The most effective programmes tailor this to the role, so that finance teams focus on payment fraud, admissions teams on applicant data, and researchers on protecting sensitive research data.
Yes. Students hold their own accounts, handle their own data, make payments, and are targeted by phishing, account takeover and scholarship or payment scams. Short, accessible awareness delivered at induction, with seasonal reminders around key deadlines, helps protect both students and the institution, because students are users of institutional systems and their behaviour affects institutional risk.
More often than once a year, and tied to moments where risk is high. A single annual module is rarely enough. A better pattern combines core training at onboarding or induction with short refreshers, just-in-time reminders and seasonal campaigns timed around admissions peaks, payment deadlines, exam periods and after any incident. Frequent, short reinforcement tends to change behaviour more reliably than one long session.
Awareness helps people recognise that a security issue exists and is broad and continuous. Training teaches people what to do in specific situations relevant to their role and is more focused and practical. A third level, education, develops deeper understanding for people whose roles carry security responsibility. Higher education institutions generally need all three, applied to the right audiences.
Make reporting simple, fast and safe. Provide a single, well-known reporting channel, add a report-phishing button in email clients where possible, acknowledge every report, and explain what happens next. Crucially, remove blame: people report more when they are confident they will not be punished for an honest mistake or a false alarm. Reporting rate and reporting speed are better measures of a healthy culture than phishing click rates.
Measure behaviour and outcomes, not just completion. Useful indicators include phishing reporting rates and reporting speed, repeat risky behaviour, MFA adoption, incident-handling metrics, tabletop exercise outcomes and audit findings, reviewed by role rather than as a single average. Avoid inventing benchmarks or relying on click rates alone, since analyses of breach data suggest click rates are not reliably reduced by awareness activity.
For institutions handling the data of people in the UK or EU, training is one of the organisational measures that support data protection, helping staff handle personal data safely, recognise breaches, and understand data subject rights. It supports compliance but does not equal compliance. Meeting GDPR obligations requires governance, policies, lawful bases, technical controls and accountable processes, decided with the institution's DPO and legal teams. Training content should not be treated as legal advice.
Full Fabric is a purpose-built higher education platform, not a cybersecurity training tool. It supports security and governance by bringing CRM, admissions, enrolment, payments, student records and reporting onto one connected record, with role-based access, auditability, and GDPR-aligned workflows such as consent, retention and subject access request handling, plus governed integrations with existing systems. This reduces the fragmentation, duplication and uncontrolled exports that drive much data risk. It does not replace training, identity, endpoint, backup or security tooling, and security still depends on how the platform is configured and used.
Higher education cybersecurity:
Threat landscape:
Phishing, MFA, passwords and identity:
Training frameworks:
Data protection:
The development and maintenance of an in-house system is a complex and time-consuming task. Full Fabric lets you turn your full attention to maximizing growth and performance.
