Australia's education sector must rethink its fragmented approach to cyber security, an expert says, warning that siloed systems are leaving schools and universities exposed to attacks that could have been stopped.
In recent years, Australia's education sector has faced a growing cyber security challenge, with universities and schools are increasingly attractive targets for cyber criminals.
The problem is, many institutions remain constrained by fragmented security systems, limited resources and complex technology environments – and the consequences are becoming increasingly apparent.
In May 2026, a cyber incident involving Instructure's Canvas learning management platform affected universities, vocational education providers and schools across Australia. The incident demonstrated how a breach involving a widely used third-party platform can expose multiple institutions simultaneously.
Meanwhile, a major Victorian Department of Education data breach, disclosed earlier this year, highlighted the dangers of inconsistent security oversight. An investigation found that attackers exploited an unpatched server vulnerability at a school, exposing student information and prompting widespread password resets.
The challenge of securing open environments
Robin Long, Regional CTO at Rapid7, said these incidents both reinforce an uncomfortable reality that cyber security is no longer simply an IT issue.
“It is fundamental to protecting students, maintaining educational continuity and preserving public trust,” Long told The Educator. “Education institutions face a particularly difficult security equation.”
Unlike many commercial organisations, universities are designed around openness, collaboration and information sharing, Long pointed out.
“Students, academics, researchers, contractors and external partners need access to systems from multiple locations and devices,” he said. “At the same time, institutions hold enormous volumes of sensitive information, including student records, financial details, health information and valuable research intellectual property.”
Long said this creates an attractive environment for attackers seeking financial gain, sensitive data or opportunities to disrupt operations.
“The challenge also becomes greater when institutions operate across multiple campuses, faculties and departments, each potentially maintaining different technologies, security processes and external suppliers,” he said. “It’s when security operates in silos, vulnerabilities can remain undetected, threat intelligence is not shared effectively and responses to incidents become unnecessarily slow.”
Fragmented security creates unnecessary risk
Long encouraged education leaders to consider a university where suspicious activity is detected within one faculty's systems.
“Without centralised visibility, security teams elsewhere may remain unaware that the same attacker is targeting their networks,” he said. “This fragmentation also creates inefficiencies. Different departments may invest in overlapping security technologies, while critical vulnerabilities elsewhere remain unaddressed.”
For education institutions already facing financial pressures and competition for skilled cyber security professionals, Long said this is “neither sustainable nor effective.”
“The answer is not necessarily more technology. It is better coordination and a clearer understanding of risk across the entire institution.”
A more coordinated approach
To address these challenges, Long said education leaders should prioritise three changes.
“First, establish institution-wide visibility of systems, users, vulnerabilities and third-party dependencies,” he said. “Security teams cannot protect assets they cannot see.”
Second, said Long, collaboration should be strengthened between campuses, faculties and external providers, ensuring threat intelligence and incident response processes are shared, rather than isolated.
“Third, shift towards proactive security, identifying and addressing the vulnerabilities most likely to be exploited before attackers can act,” he said. “Importantly, this requires leadership beyond the IT department.”
Long said Vice-chancellors, principals and governing boards must recognise cyber resilience as an institutional responsibility.
“Australia's education institutions cannot eliminate every cyber threat. But they can eliminate many of the organisational blind spots that make attacks more damaging,” he said.
“Protecting education's future will depend not simply on investing more in cyber security, but on ensuring that existing resources, technologies and teams work together.”