Why education IT teams must protect both human and machine identities

Date:
Fri, 16 Oct 2026 10:31:32 +0000

Description:
AI is intensifying education cyber threats, exposing dangerous gaps in human and machine identity security.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter At the start of every school year, schools, colleges and universities across the UK race to onboard thousands of new students, faculty and staff members, provisioning accounts, issuing credentials and connecting a wave of new devices to institutional networks.

That operational pressure creates opportunities for attackers, and this year, AI is amplifying the threat more than ever. Not only are phishing campaigns more convincing, but a hidden layer of unmanaged machine identities is expanding the cyber attack surface. Anne Cutler Social Links Navigation

VP of Global Communications at Keeper Security. Attackers are persistent and the education sector remains a top target with many facing cyber attacks weekly. The UK Governments cyber security breaches survey revealed that 27%
of further and higher education institutions reported experiencing a breach
or attack at least weekly, compared to 14% of primary schools and 20% of secondary schools. Latest Videos From TechRadar Watch full video here: Navigating the expanded threat window The education sector is one of the highest targeted industries for ransomware, credential theft and data breaches. For hackers, schools and universities present an appealing combination of high-value data, including student records, financial information and research, alongside underfunded IT departments and an enormous, ever-rotating user base.

The back-to-school season intensifies this pressure. Bulk account creation, mass device enrolment and a surge of third-party application onboarding all happen simultaneously, creating a greater risk of misconfiguration and excessive access rights. The UK Government found that no tier of the
education sector had a majority of institutions compliant with all of the governments Cyber Security 10 Steps. You may like When identity isnt human: securing the agentic enterprise AI has crossed a cybersecurity redline now what? Identity and attack paths - can you stop hackers getting from A to B?

Just 14% of primary schools, 23% of secondary schools, 33% of further education colleges and 45% of higher education institutions had covered all 10. As thousands of new identities and devices enter this already insecure environment, gaps in security controls can become harder to identify and manage.

AI has made cybersecurity threats significantly more dangerous. The same government survey found phishing to be the main threat identified by institutions that had suffered a breach, and those emails can now precisely mimic communications from student funding offices, IT helpdesks or university leadership, with none of the traditional red flags that once made them easy
to spot. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Keeper Securitys research into AI and cybersecurity in education found that 41% of schools have experienced AI-related cyber incidents, including
phishing and misinformation, while 90% of education leaders expressed concern about AI-related cybersecurity threats. Yet only one in four respondents felt very confident recognizing AI-enabled threats such as deepfakes or AI-driven phishing.

As AI makes social engineering attacks more convincing, education
institutions need to reinforce human awareness with stronger identity and access controls that do not rely on users spotting every malicious message. The hidden attack surface: non-human identities in EdTech As students and staff begin the new academic year, IT teams will rightly be focused on securing human accounts, but there is another, much larger population of digital identities that can easily escape attention: Non-Human Identities (NHIs). What to read next CIOs must rethink identity now people are being outnumbered by nonhuman entities Cybersecuritys identity crisis: why trust
can no longer begin and end at login The ascent of autonomous attacks and the race to contain them

NHIs are now embedded throughout modern education environments, from service accounts that synchronize student records with learning platforms to API keys connecting third-party applications, digital textbooks and payment systems.

Machine identities and certificates authenticate everything from campus Wi-Fi and smart boards to lab equipment and security cameras, while cloud workloads automate backups, research pipelines and administrative processes. Similarly, AI agents powering admissions chatbots, helpdesks and grading tools are
adding yet another layer of identities and access privileges that
institutions need to manage.

These identities are essential to keeping schools and universities running, but they can also create significant security gaps when credentials are
rarely rotated, old integration tokens remain active or automated accounts
are granted more access than they need.

Unlike employees and students, NHIs are not naturally caught by onboarding
and offboarding processes. Without a complete inventory, organizations can struggle to know which identities exist, who owns them and what they can access.

The cybersecurity conversation in education has historically centered on protecting students, teachers and administrators, but the machine identities powering modern EdTech deserve the same scrutiny, because regardless of whether a breach stems from a human or machine, the impact is the same.

Back-to-school is a useful opportunity to review the full identity estate both human and non-human remove identities that are no longer required and tighten access for those that remain. How education IT teams can reduce their risk For most institutions, the fundamentals of managing humans are manageable. The critical gap is visibility and governance over the NHIs that power modern EdTech, like service accounts, API tokens, machine certificates and AI agents that multiply with every new integration. Security teams should take these steps to help secure NHIs and humans alike.

Enable multi-factor authentication

As the new semester begins, organizations should ensure MFA is enforced
across all faculty, staff and student accounts, with new users defaulted into it from the moment they are provisioned. MFA remains a fundamental defense against credential-based attacks.

Audit privileged access

Many accounts give users privileged access beyond whats necessary for their role. Privileges should be audited for both humans and non-humans. This includes removing access for departed employees and students, retiring
expired service accounts and eliminating unnecessary administrative privileges.

Deploy enterprise password managers

Password security remains one of the hardest problems for security teams to solve. Awareness and training can provide students, faculty and staff with
the knowledge on how to create strong passwords , but converting that knowledge into practice is difficult because password reuse, written
passwords and browser storage remain common. Enterprise password managers remove that gap, enabling users to create and store strong, unique credentials.

Build a non-human identity inventory

You cant secure what you cant see. Schools should catalogue every service account, API key, machine certificate, cloud identity and AI agent. Establish ownership and record what each identity can access.

Establish credential rotation policies

Its important to establish credential rotation policies for machine identities, paying particular attention to AI agents and third-party EdTech integrations added for the new school year. The Canvas learning management system hack, reported in April 2026, affected almost 9,000 educational institutions globally a reminder that third-party credentials require the same rotation discipline as internal accounts.

Third-party access should be regularly examined and security teams should scrutinize the security of all current and potential partners and suppliers.

Updated training

Security awareness training needs to keep pace with the threat landscape, particularly around phishing, where AI-generated messages may be indistinguishable from legitimate institutional communications. Staff should independently verify unusual requests rather than relying on visual cues
alone Getting ahead of the rush Back-to-school will always put education IT teams under pressure, but it does not have to create an open window for attackers. As institutions begin the new academic year, security must extend beyond onboarding students and staff to understanding every identity with access to critical systems and data.

By enforcing strong authentication , tightening privileged access, improving credential hygiene and gaining visibility over the growing population of non-human identities, IT teams can significantly reduce their exposure.

Security should be treated as a continuous discipline, not a back-to-school checklist. It is critical that every human and machine identity has the right access, for the right purpose and for only as long as it is needed. We've featured the best antivirus software. This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/why-education-it-teams-must-protect-both-human-a nd-machine-identities


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)