Cybersecurity and IT for Education
Colleges and schools need IT that serves students and faculty, and security that protects student records without locking down an open campus. Defensible's leaders ran technology at The Juilliard School. We bring that experience to assessments, vCISO leadership, identity, network security and managed IT for academic institutions.
Founded by former Stroz Friedberg leaders, with technology leadership experience at The Juilliard School.
Why Is Campus Cybersecurity Different?
A campus is an open network by design. Students and faculty bring their own devices, staff turn over every term, and research, admissions and finance systems all hold sensitive data.
Most institutions run lean IT teams that spend their days on help desk work. Security strategy, identity hygiene and network clean-up wait for a quiet week that never comes.
Student data
Education records protected under FERPA, plus financial aid data.
Bring-your-own devices
Thousands of unmanaged laptops and phones on campus networks.
Identity churn
Accounts created and retired every semester for students, faculty and staff.
Legacy networks
Firewall rules and systems that have accumulated for decades.
Help desk overload
IT staff consumed by tickets, with no time for security.
Phishing and BEC
Staff targeted with payroll, vendor and gift-card fraud.
Leadership With Juilliard Experience
Our CEO and founder, Steve Doty, served as CTO for The Juilliard School and led the university through a global IT transformation, including technology modernization, organizational restructuring and expansion into China. He was the first security expert the School hired.
Former CTO of The Juilliard School and former Managing Director at Stroz Friedberg.
Former Director of IT Engineering at Juilliard; helped implement its Oracle ERP/SIS.
Former FBI senior executive with senior roles at Stroz Friedberg and Juilliard.
Background spanning higher education technology and client leadership.
How Should Schools Manage Identity for Students and Staff?
Identity is the front door to every campus system. Get it right and most phishing, account takeover and offboarding gaps close with it.
Identity for Students and Staff
Consistent accounts and access from enrollment or hire through graduation or departure.
- Single sign-on and MFA — MFA for staff, faculty and anyone with administrative access
- Lifecycle automation — Accounts created and removed on schedule each term
- Role-based access — Least privilege for student information, finance and research systems
Campus Security and IT Operations
The security foundation and day-to-day IT a lean team can't cover alone.
- Assessments — CIS Controls-based reviews with peer benchmarking
- vCISO — Program leadership, policies and board or trustee reporting
- Network and firewall — Rule audits, segmentation and monitoring
- Managed IT and MSSP — Help desk support, 24/7 monitoring and incident response
Institutions We Support
From small colleges to large universities and education-focused nonprofits.
IT assessments, roadmaps and organizational realignment.
Complex networks across campus, cloud and remote sites.
Global campuses and high-profile reputations.
Secure data and AI workflows for mission-driven teams.
How Does an Engagement Start?
A structured approach that respects shared governance and the academic calendar.
- STEP 1Listen
Stakeholder interviews across academic, administrative and IT teams.
- STEP 2Assess
Document review and a CIS Controls-based evaluation.
- STEP 3Benchmark
Compare staffing and security maturity with peer institutions.
- STEP 4Roadmap
Immediate risk reduction plus short- and long-term priorities.
- STEP 5Partner
vCISO, managed IT or managed security, as needed.
IT and Cybersecurity Modernization for a Liberal Arts College
- Customer: A small liberal arts college in New York City
- Challenge: After a leadership transition placed IT under a new CFO, the college needed a full evaluation of its IT infrastructure, cybersecurity posture and organizational structure
- Solution: Document review, stakeholder interviews, peer benchmarking and a CIS Controls-based evaluation that found gaps in incident response, identity management and system hardening
- Result: A roadmap to modernize IT, strengthen cybersecurity and realign the department to institutional goals
Firewall Rule Audit and Cleanup at a Large University
- Challenge: More than 20 years of accumulated firewall rules across on-campus networks, AWS, Azure and SD-WAN sites, many obsolete, redundant or overly permissive
- Approach: Manual review of the oldest and most critical rules, combined with automated tools to find unused, redundant and misconfigured rules
- Result: A reduced attack surface, least-privilege rules, simpler management and ongoing monitoring of rule changes
What Did We Build at Juilliard?
Juilliard needed to protect its New York campus and a new campus in Tianjin, China. Through Defensible's vCISO program, the School went from no dedicated cybersecurity personnel or official programs to a modern security practice aligned with NIST, with MFA, monitoring, vulnerability management and a dedicated cybersecurity budget. Read the Juilliard case study.
"Defensible Technology has proven to be a trusted and capable provider of services in the fields of Information Technology implementation and services, as well as Security Services. I have known and worked closely with Defensible's CEO, Steve Doty, and his colleagues for years. They are excellent professionals and it is a pleasure working with them. I recommend Defensible without hesitation for any organization that is seeking experienced high quality talent that can be trusted to deliver the valuable services they offer."
— Ed Stroz, Founder of Consilience 360, LLC and Stroz Friedberg, LLC
Frequently Asked Questions
Does Defensible work with colleges and universities?+
Yes. Our case studies include a liberal arts college in New York City, a firewall audit for a large university and a long-running vCISO engagement with The Juilliard School, where our CEO previously served as CTO.
What does FERPA require for cybersecurity?+
FERPA protects the privacy of student education records at schools that receive U.S. Department of Education funds. It doesn't prescribe specific controls, so institutions rely on access control, MFA, logging and vendor review to protect records. This is general information, not legal advice.
Does the GLBA Safeguards Rule apply to colleges?+
Institutions that participate in federal student aid programs are generally expected to comply with the GLBA Safeguards Rule for student financial information. That includes a qualified individual, a written risk assessment and MFA. Confirm your obligations with counsel.
Can you work with our existing IT team?+
Yes. We can work alongside campus IT as a co-managed partner, adding security operations, leadership and project capacity while your team keeps ownership of the systems it knows.
Where do you recommend starting?+
With an assessment. A CIS Controls-based review, stakeholder interviews and peer benchmarking give leadership a clear picture and a prioritized roadmap.
Give Your Campus IT a Clear Roadmap
Talk to people who have run technology at a world-renowned school. We'll start with your priorities and show you where the risk really is.