The State of University Cybersecurity: 3 Major Problems in 2023 | UpGuard

UpGuard’s 2023 analysis of 1,500 U.S. universities and 5,000 vendors finds higher education has excessively large web-facing attack surfaces (hundreds to thousands of domains with ~5% unmaintained), risky exposures (10% with open RDP; 23% among top 500; 45% running end-of-life PHP; known exploited vulnerabilities in 48% of all and 70% of top 500), and elevated third-party risk (vendor scores lagging, many below safe thresholds). The report links lower security ratings to greater ransomware/data breach susceptibility and recommends attack surface reduction, layered security controls, and HECVAT-based vendor risk management, noting improved scores among HECVAT-participating vendors and institutions.