In five short years, the Consortium of Cybersecurity Clinics has grown from a small cohort of four founding clinics into a global network of over 60 clinics across eight countries and five continents.

See for yourself with our “What is a Cybersecurity Clinic?” video

To celebrate this anniversary, the Consortium has released a new video that highlights how the clinic model works, the impact we are making together, and why continued support is vital to promoting cybersecurity as a public good.

A Moment to Celebrate: Research and Teaching Day in Philadelphia

The Consortium hosts its annual Research and Teaching Day to inspire community building and to share ideas, practical tools, research, and experiences that help strengthen clinics worldwide. This year, nearly 50 participants representing more than 30 institutions gathered at Temple University in Philadelphia for our largest and most collaborative gathering to date.

Looking Ahead

Consortium members have built this community from the ground up through peer collaboration and learning. As we look to the next five years and beyond, we will continue to work toward a future where every community has access to cybersecurity expertise, creating a more secure and equitable digital world.

Thank you to our members, our brilliant students, and all who have shared in the first five years of our journey. Cheers (and high-fives!) to five years of impact—and many more to come!

On April 23, 2026, the Consortium of Cybersecurity Clinics hosted its biannual event, held each semester, called the “Clinic of Clinics.” This event gives students in a school’s cybersecurity clinic a chance to connect with peers worldwide and hear from experts in their fields. The 90-minute session featured a keynote presentation from Ian Mandell, Claims Counsel at Coalition, Inc. Ian led a lively discussion with participants, sharing his insights and experience in response to questions from the community. The session concluded with peer networking for clinic students and alumni, allowing them to connect and share ideas with students from other clinics.

Guest Speaker: Ian Mandell, Claims Counsel at Coalition, Inc.  

Ian Mandell shared with students that his own path into cybersecurity was not straightforward. Originally majoring in Middle Eastern Studies and Security Studies, he emphasized that even a winding path can lead you to the right place with dedication and passion.

Insights from Mandell’s Presentation

Drawing from the cyber insurance claims data Ian shared, he discussed some of today’s most common cyber threats, including Business Email Compromise (BEC), Funds Transfer Fraud (FTF), and ransomware. According to data from Ian’s presentation, Coalition’s global cyber insurance claims are broken down as follows: 

• 31% Business Email Compromise (BEC), 
• 27% Funds Transfer Fraud (FTF), and 
• 21% Ransomware. 

Industries with more customer and vendor touchpoints generally experience a higher frequency of claims, while more data-intensive industries typically face higher losses pre-incident.

Key takeaways from Ian’s presentation include:

• Business Email Compromise (BEC) Ian explained that these attacks can begin as small incidents but become footholds for much larger breaches, making early detection critical.
• In the case of Funds Transfer Fraud (FTF), FTFs can result from various tactics, such as cybercriminals impersonating a bank representative to gain access to accounts. Ian emphasized safeguards such as multifactor authentication (MFA) and verifying requests before sharing sensitive information over the phone.
• In these FTF cases, time is critical. Once funds have been transferred, the victim may have as little as 24 hours to attempt to recover stolen funds before the likelihood of recovery decreases significantly.
• Coalition’s data shows businesses now refuse ransom demands 86% of the time. While ransomware demands have increased, organizations are better able to avoid paying ransom demands due to many reasons, such as stronger backup practices. However, ransomware incidents still cost organizations time and money, and there is no guarantee that cybercriminals will not retain stolen data; negotiation may still be necessary to assess the threat level.
• “Dual extortion” ransomware attacks are becoming more common, with threat actors both encrypting systems and threatening to publicly release stolen data. Immediate containment and isolation of affected systems can help reduce costs and prevent a total system shutdown.  
• About 59% of ransomware attacks exploit VPN vulnerabilities, including commonly used platforms such as SonicWall, Fortinet, and Cisco.
• Beyond the technical aspects, Ian highlighted the human element involved in ransomware negotiations, including analyzing cybercriminal groups’ reputations based on whether they keep their end of the deal. Some of these groups operate customer-service-style support lines for victims.

Q&A SESSION

Following the presentation, the floor opened to a spirited dialogue between our students, alumni, and clinic instructors. Though the clock cut the Q&A short, the following community questions and responses from Ian* capture the core of the discussion.

Q: Do small business owners feel overwhelmed by the excessive recommendations given to them? And if so, how do you ease that tension?

A: Everything they worked so hard to create could just evaporate overnight because of one cyber criminal. Their data is taken, and they think it is all over. We bring in excellent vendors who can help take the burden off their shoulders. Once the initial shock passes, they begin to see the work being done in a timely manner, which lightens the burden on these small organizations. 

Q: For BEC and FTF, are you seeing more threat actors using AI or deepfakes to pull these off, or is social engineering still the primary attack vector?

A: We are seeing a lot of social engineering right now, but trust me, we are all concerned about AI moving forward. We’re seeing stories about AI finding vulnerabilities and bugs, but it can work both ways. We’re also concerned about how effectively AI can mimic people, which presents a challenge when verifying if we are talking to a real person or AI. 

* Please note that the questions and answers have been paraphrased for the purpose of this recap. Ian’s views are his own, and informed by his personal and professional experience, but are not intended to represent Coalition, Inc.

Breakout sessions

The session concluded with a lively peer networking session for clinic students and alumni. These exchanges offered a rare glimpse into the diverse lives of peers at other clinics. It became clear that Ian’s non-traditional path into cybersecurity wasn’t an outlier; it was a theme. Many students with varied backgrounds shared how the clinic served as an essential entry point to the field of cyber. 

Another powerful truth emerged: these aren’t just classmates. They are future colleagues. The bonds formed here are the seeds of a professional network that will shape the cybersecurity workforce for years to come. 

Final Reflections

The Spring 2026 “Clinic of Clinics” pulled back the curtain on a critical, yet often-unseen, pillar of the industry: the intersection of incident response, policy, and cyber insurance. By leveraging front-line data and his deep expertise in law, policy and cyber, Ian demonstrated that cybersecurity for small organizations is about more than just defense; it’s about resilience.

While offensive security often grabs the headlines, the real-world impact of a cyber event is managed through precise reporting, clear client communication, and the strategic application of insurance data. For the next generation of practitioners, mastering these “human-centric” professional skills isn’t just an add-on. It’s what will allow them to lead the industry and protect the communities that need it most. 

About the Consortium: 

The Consortium of Cybersecurity Clinics is a global network of higher-education-based cybersecurity clinics and allies working to advance cybersecurity education for public good. We serve as a forum for faculty, students, trainers, and advocates to network and share knowledge, expand the reach of cybersecurity clinics, and lower the barriers for other institutions of higher education to successfully establish their own clinics.

When a nonprofit employee wants to use a free AI tool to summarize sensitive case notes, or a small business owner realizes they could save hours by uploading financial spreadsheets into a chatbot, the question they ask our clinics is the same: “Is this safe?”

These aren’t hypothetical concerns about the distant future; they are fundamental security questions for the here and now. For our member clinics, responding to them is a core part of providing cybersecurity support to community organizations in 2026.

For seven years, cybersecurity clinics have served as trusted partners for community organizations with little to no access to digital security support. Today, as the rapid adoption of AI tools by organizations of all sizes expands the attack surface and introduces new risks, cybersecurity clinics are stepping up to meet the challenge. 

Expanding the Scope for Digital Security

AI is often treated as a ‘shiny new object,’ but cybersecurity clinicians see it differently. We believe that protecting a community organization requires addressing AI safety and cyber risk as two sides of the same coin.

As we’ve seen with other technological advancements, the least-resourced organizations often bear disproportionate digital security risks. That’s why cybersecurity clinics are training our students to help our clients—like small businesses, non-profits, K-12 schools, local governments, and rural water utilities—manage their AI security as part of an overall security assessment. 

Luckily, we don’t need to reinvent the wheel to meet student and client needs at the intersection of AI risk and security. As trusted partners in their communities, cybersecurity clinics are already on the ground. Our students are already learning the hands-on skills essential to enabling safe and responsible use of AI in the real world. By connecting the dots between AI and cyber risk, we see that the digital security perimeter has expanded, and with that expansion comes a strategic opportunity to do more for our students and our clients.

Cori Faklaris, Faculty Director of the UNC Charlotte Cybersecurity Clinic, sees this responsibility firsthand in her community: “As AI becomes an invisible layer in every community organization, it’s both a potential helper for their operations and a huge new threat. We feel a duty to help nonprofits in Charlotte navigate AI and leverage it safely. This work empowers our students to demystify AI risk and to create human-centered security protocols that even the smallest nonprofit can implement.”

Developing Practical Resources for Real-World Applications

The Consortium’s AI Risk Management (AIRM) Working Group has spent the past 9 months building the tools that faculty and students need to navigate this shift. In collaboration with experts at UC Berkeley’s Center for Long-Term Cybersecurity’s AI Security Initiative (CLTC AISI), we have developed:

• AIRM Resource Library: A hub for existing literature and resources on AI risk tailored for cybersecurity clinical education and practice.
• AI Risk Management Curriculum: Course modules specifically tailored for clinical education, covering topics such as AI opportunity and risk mapping, mitigation strategies for resource-constrained organizations, and technical threats like prompt injection.
• AI Risk Assessment Framework: Practical tools that can be layered onto a clinic’s existing cybersecurity risk assessment framework to help community organizations understand and act on AI risk.

Together, these resources serve as the building blocks of a new standard for digital security education, training, and service in cybersecurity clinics.

As Nada Madkour, Interim Director of CLTC AISI, explains, these integrated tools are a necessity for modern defense: “Cybersecurity hygiene must now include AI safety. Any organization that utilizes AI opens itself to new attack vectors, and AI now allows malicious actors to operate at heightened speeds, scales, and levels of sophistication. It is very important to train our students to address these disciplines in unity, because any organization that treats them in silos will always be underprepared for the threats that live at their intersection.”

The “Win-Win” of Modern Clinical Education

By integrating AI risk into our existing structures, both groups at the heart of our mission benefit:

The Student (Workforce Development)	The Client (Community Resilience)
Real-World Skills: Students learn to manage AI risk in real-time, preparing them for a career path where skills in technical AI safeguards, ethics and communication are essential.	Integrated Protection: Community organizations receive digital security support, including cyber and AI, from a single source. They don’t need separate providers for the two.
Field-Ready Talent: Clinic students graduate with a “bilingual” skill set, competent in both traditional cybersecurity and AI risk management.	Safe Innovation: Organizations can use commercial AI tools to work more effectively while understanding the associated risk and best practices.

Clinics “Closing the Gap” 

History shows that with technological advancements, small community organizations are often the most impacted and the last to receive support. Today, these organizations are encouraged to adopt commercial AI tools that promise to save time and resources, yet they frequently lack the specialized support to navigate the associated risks. Our goal is to ensure that a “knowledge gap” does not become a permanent “safety gap” for the vital organizations our communities rely on.

The Consortium provides the skills, network, and clinical structure to meet the emerging workforce and community needs introduced by AI. In a digital era that is constantly evolving and expanding, our clinics are, too. By advancing clinical pedagogy and practice, clinics are doing what we have always done: standing in the gap to ensure our students and our communities have the expert support and practical skills they need to thrive.

In November 2025, the Consortium of Cybersecurity Clinics published its very first peer-reviewed publication on cybersecurity clinical education. The article, “Protecting Communities while Training Future Cybersecurity Professionals: Lessons from the Consortium of Cybersecurity Clinics,” was co-authored by Isak Nti Asare, Scott Shackelford, Jungwoo Chun, and Sarah Powazek and published in The Cyber Defense Review.

The article featured case studies from Consortium members Indiana University, MIT, and UC Berkeley that illustrate the role clinics have played in supporting critical infrastructure and advancing national cyber resilience efforts. The work across these three clinics and other members of the Consortium laid the foundation for expanding the cybersecurity clinic model worldwide, with the benefit of bolstering national security. The Consortium of Cybersecurity Clinics plans to build on this success by supporting and fostering additional collaborative research on cybersecurity clinics between Consortium members.

The Significance: Why Clinics Are Critical to National Security

National security vulnerabilities often originate at the local level, where under-resourced public-serving organizations are increasingly targeted by adversaries. 

By training students to provide professional-grade, pro-bono services to organizations at the municipal and nonprofit levels, the article claims that clinics address two longstanding gaps in public sector capacity: “They redistribute capacity into vulnerable nodes ignored by markets and underserved by states… [And] cultivate a workforce oriented toward civic protection.” This dual-purpose model, scaled nationally by the Consortium to create a federated infrastructure of community-based cybersecurity services, presents a governance innovation that bolsters national security. It accomplishes this by strengthening local resilience and addressing the workforce shortage by training the next generation of cybersecurity professionals with experience in public-interest cybersecurity.

The Consortium of Cybersecurity Clinics serves as a catalyst for this model, facilitating resource sharing, standardizing best practices, and enabling the rapid, scalable growth of clinics needed to meet national demand.

High-Impact Case Studies

The article features three case studies illustrating the diverse and high-impact interventions of member clinics:

• The MIT Cybersecurity Clinic supports city governments in New England, focusing on risk assessments and policy updates to increase local governance capacity. Students engage in rigorous experiential learning, negotiating with city managers and drafting actionable policy documents. The clinic distilled the industry-leading NIST Cybersecurity Framework from its 108 controls to 23 core controls most relevant to small organizations. The streamlined assessment framework has been shared across the Consortium network.

• The Indiana University (IU) Cybersecurity Clinic works extensively with small and rural municipalities, private utility providers, and nonprofits in the Midwest. IU’s interdisciplinary teams focus on governance audits, the development of formal incident response plans, and helping organizations secure cyber insurance. One notable case involved working with a Department of Housing and Urban Development (HUD)-funded community action agency serving 60,000 low-income residents, where IU teams identified vulnerabilities and recommended improvements.  Students also learn to translate technical findings into actionable policies within municipal codes and procurement rules. 

• The UC Berkeley Cybersecurity Clinic focuses on defending politically vulnerable nonprofits (such as human rights and election-integrity groups) that are often targeted in hybrid conflicts and disinformation campaigns. Through its work with organizations like reproductive health providers and election-integrity advocates, the UC Berkeley Cybersecurity Clinic demonstrates that civil society resilience is integral to national security. As of Fall 2025, the clinic at Berkeley had supported more than 230 nonprofits in strengthening their cybersecurity defenses. By defending civil society organizations, the clinic contributes to our nation’s democratic durability: strengthening our democratic institutions against interference from adversaries.

Cultivating the Future Workforce

Clinics also directly address the major national challenge of workforce shortages. As of early 2025, there were over 450,000 unfilled cybersecurity jobs. They provide a practical solution to the paradox of “entry-level” jobs demanding prior experience by providing students with hands-on learning via real-world client engagements. Students build technical, policy, and communication skills in live operational environments, ensuring their work is both high-quality and aligned with professional standards. This cultivates a next-generation workforce oriented toward public-interest cyber pathways.

A Scalable Model: The Consortium of Cybersecurity Clinics

The clinic model’s effectiveness and scalability are driven by the innovations developed in the Consortium of Cybersecurity Clinics’ member clinics.

With 56 total members, the Consortium includes large research universities, small liberal arts colleges, community colleges, women’s colleges, and minority-serving institutions. Member clinics co-develop curricula, define best practices, and refine standardized methodologies that are shared and adapted by peers. 

In conclusion, the Cyber Defense Review article argues that clinics are a field-tested model for strengthening national cyber resilience. The Consortium is transforming these efforts into a scalable cyber infrastructure that protects communities, supports critical services, and cultivates the cybersecurity workforce needed for tomorrow. 

This article is an exciting first example of collaborative research and peer-reviewed scholarship on cybersecurity clinical education from the Consortium. Congratulations to the authors, Isak Nti Asare, Scott Shackelford, Jungwoo Chun and Sarah Powazek, for trailblazing this field of work, and thank you for your time, expertise, and dedication to supporting cybersecurity clinics.

On November 13, 2025, 135 students from more than 30 colleges and universities met for the Fall 2025 “Clinic of Clinics.” This biannual event, held by the Consortium of Cybersecurity Clinics, gave these future cybersecurity professionals the opportunity to connect with their peers while hearing from a panel of current experts in the field. 

The Consortium of Cybersecurity Clinics is a collaborative network of cybersecurity clinics, which are higher education-based programs that train students to provide pro-bono, cybersecurity capacity-building services to real organizations in their communities. Since its inception, the Consortium’s member clinics have trained over 3,700 students in service of more than 900 combined clients. 

Cybersecurity Journeys   

Introducing a panel featuring clinic alumni, panel moderator Jonathan Edward, Co-Founder and CEO of New Harbor, a company specializing in automated security services for small organizations, stated, “there is no single way to build a career in this field.” The three panelists only further proved this point as they shared their journeys from students to the professionals they are today. 

A Day in the Life  

After sharing their stories, the panelists spoke on what a typical workday entails for a cybersecurity professional. 

For example, Huang works in incident response at CrowdStrike, where she is responsible for taking immediate action when an attack occurs. She is the first person on the scene to analyze the who, what, where, why, and how of the attack, and while she needs a host of technical skills to be able to analyze these attacks, she stressed the empathy her job requires, as she always shows up in the midst of a crisis. Huang also stressed the importance of focusing on social engineering, as it is the cause of a significant portion of cyberattacks. 

Brown, on the other hand, works to ensure her clients follow all necessary requirements to comply with various standards, such as International Organisation for Standardization (ISO) and System and Organization Controls (SOC), walking them through various steps of the certification process. In addition to technical skills, Brown’s work requires a vast knowledge of the cybersecurity standards and requirements different organizations must comply with to strengthen their cybersecurity posture and meet customer requirements. 

While his fellow panelists’ work focuses primarily on consulting, Gilmore explained that he spends his days developing code. He works with a small team to create fast, simple, and secure solutions for his clients, and he stressed the importance of collaboration and continued learning.  

Advice for Clinicians  

Wrapping up, the panelists took a moment to consider what they had learned since their time as clinicians, and they offered the following advice to the attendants:

1. “Find something you are passionate about and be confident in it.” Brown stressed the importance of finding specific areas or projects that are personally exciting. She has found this passion not only improves overall work performance but can help someone stand out to potential employers.
    
2. “Leverage the skills you already have.” Gilmore emphasized the importance of using one’s current skillset in unique ways to gain opportunities in a new field.
    
3. “There is always something more to learn.” Huang highlighted the importance of accepting that it is impossible to know everything in one’s field, which is why being a professional means continually learning and improving.  

Q&A Session  

After the panel, students were given the opportunity to ask the panelists questions directly. Questions focused on becoming more involved and eventually securing a job in the cybersecurity field, as many attendants either recently entered or will soon be entering the job market. Their advice can be summed up in three key takeaways.

1. Always seek out people and opportunities that can help you learn more.  
2. Find or create a project of your own to stand out.  
3. Get comfortable with admitting when you don’t know something. 

Breakout Sessions  

The session concluded with students being moved into breakout rooms, where they were able to connect with their peers and share their clinic experiences. Using the prompts provided, students engaged in meaningful discussions about their own cybersecurity journeys.  

Final Reflections  

Demonstrated by the panelists’ remarks, the Fall 2025 Clinic of Clinics highlighted some of the most important traits in a cybersecurity professional: a continuing desire to learn and a passion for this work. As the field of cybersecurity continues to evolve, events like this will serve as an opportunity for each new generation of professionals to engage in the never-ending quest to improve.  

Cybersecurity clinics — university-based programs that train students to provide pro bono cybersecurity assistance to organizations with limited resources — are expanding across the nation and around the world. Clinics equip students with real-world experience as they help local nonprofits, small businesses, and governments defend against cyber threats.

The clinic model gained momentum in 2021 with the launch of the Consortium of Cybersecurity Clinics, a collaborative effort launched by UC Berkeley, MIT, Indiana University, and the University of Alabama. What began as a small network for clinic leaders to share ideas and best practices has evolved into a growing international alliance bolstered by higher ed, philanthropists, and industry, signaling a global shift toward hands-on cybersecurity education in service to the public good.

The Consortium of Cybersecurity Clinics has experienced unprecedented growth over the past year. With many new clinics launching and existing programs expanding, the 2024-25 academic year has been the Consortium’s largest period of growth since our founding in 2021:

• 56 total member clinics have joined the Consortium, with 41 U.S. clinics in 27 states and the District of Columbia. 
• Global expansion in North America, Europe, Asia, and South America, with first-in-country clinics launched in Canada, Peru, Sri Lanka, and Pakistan — plus the Consortium’s first-ever high school-level clinics in Arizona.
• Member clinics trained more than 2,200 students and provided cybersecurity services to over 700 clients.

As our members kick off the Fall 2025 term, we are proud to reflect on their accomplishments and highlight just how significant a leap forward this past year has been. The metrics shared below are aggregated from data provided by 39 of our member clinics.

Multiplying our Alumni Base

Cybersecurity clinics serve a dual purpose: they provide pro bono cybersecurity services to under-resourced community organizations and train the next generation of cybersecurity professionals. By supporting real-world clients, clinic students gain hands-on experience and develop the depth of technical knowledge and breadth of professional skills needed to meet the unique and evolving cybersecurity challenges of community organizations. Students in these programs are being trained at a rate not yet seen before: in the 2024-25 academic year alone, 39 clinics reported training a total of 2238 students — more than double the cumulative total of clinic alumni between Fall 2018 and Spring 2024.

Impact Spotlight: Student Testimonial

“Participating in the Cyber Clinic at Old Dominion University wasn’t just an internship — it was a transformational experience that completely reshaped how I approach cybersecurity.

From day one, I realized this program was different. It blended technical knowledge with communication, professionalism, empathy, and real-world problem-solving. This internship sharpened so many of my skills: technical, analytical, writing, communication, and perhaps most importantly, my ability to empathize and consult like a professional.”

– Carla Belfiore, Student Intern, Old Dominion University,
Coastal Virginia Center for Center Innovation (COVA CCI) Cybersecurity Clinic

Global Growth

This year, the Consortium welcomed new clinics at universities in Southeast Asia, Central Asia, and South America. In Taiwan, our partners at the National Institute of Cyber Security (NICS) have used Consortium support and resources to launch cybersecurity clinics at 10 universities across the country — reaching urban centers as well as more rural communities in northern, central, southern, and eastern Taiwan.

In their first year of operation, the Sri Lanka Institute of Information Technology (SLIIT) trained 176 students and provided services to 44 micro, small, and medium enterprises (MSMEs) in Sri Lanka. Their Program Coordinator, Kavinga Yapa, shared, “The success of our first year demonstrates the real-world value of the cybersecurity clinics model. By engaging both students and MSMEs, we have been able to bridge academia with community needs. Students gained hands-on experience applying structured risk assessment frameworks, while MSMEs received practical guidance to strengthen their security posture. We are proud that SLIIT has emerged as the first university in South Asia to join the Consortium of Cybersecurity Clinics, and we look forward to expanding this impact further with continuous support and collaboration.”

Impact Spotlight: Securing Small Critical Infrastructure

The San Diego Cyber Clinic, a collaboration between San Diego Cyber Center of Excellence (CCOE), California State University San Marcos (CSUSM), National University and San Diego State University (SDSU)

Last year, a team of five students from the San Diego Cyber Clinic completed a cybersecurity assessment for a local Municipal Water District. The engagement encompassed a range of activities to strengthen the security of the district, including social engineering exercises, penetration testing, and a targeted phishing campaign to evaluate and build staff awareness. 

When asked about the project outcomes, Lisa Easterly, President & CEO of CCOE, shared, “In addition to identifying vulnerabilities, the students developed essential documentation to support the district’s cybersecurity posture, including an Incident Response Plan, Disaster Recovery Plan, and Business Continuity Plan. By integrating these components, the project not only uncovered risks, but also provided a roadmap for the district to enhance its resilience against cyber threats.”

Scaling Services for Community Organizations

In addition to providing students with skills-based, experiential learning, clinics serve as a vital local resource for strengthening community cybersecurity. The Consortium’s member clinics support community organizations with foundational cybersecurity services, including risk assessments, policy development, and training that they would otherwise struggle to access.

In our Growth and Impact blog post from March 2024, we proudly shared that our clinics had served a total of 83 resource-strapped client organizations. Remarkably, in the last year alone, the Consortium’s member clinics served 713 community organizations, dramatically growing the volume of clients benefiting from pro bono clinical services in the U.S. and around the world.

Clinics support a wide range of community organizations, with some focusing on specific types of clients. For example, the DePaul Cybersecurity Clinic works exclusively with community-based nonprofits in the Chicago area. Looking at data from 82% of last year’s clinic clients:

• Small critical infrastructure entities — such as utilities, state and local governments, healthcare providers, and K-12 schools — made up 47.5% of the total.
• Small businesses were the next largest group at 30.4%.
• Nonprofits followed at 17.3%.

Impact Spotlight: Client Testimonial

Louisiana State University Cyber Clinic directed by Professor Aisha Ali-Gombe

When Permanent Coatings, a family-owned industrial paint maker in Denham Springs, Louisiana, sought to strengthen its cybersecurity posture, it turned to the Louisiana State University (LSU) Cyber Clinic, which specializes in assisting local small businesses. After attending several LSU Cyber Clinic seminars hosted in partnership with the Louisiana Small Business Development Center, Operations Manager Luke Dwinell-Janopaul requested a personalized consultation from the clinic.

“I think the biggest part has just been the knowledge that the Cyber Clinic has given us, which is half the battle when it comes to cybersecurity,” he said. With guidance from the clinic, the company updated its backup practices, secured physical and digital ports, and built defenses against their biggest threat: social engineering attacks.”

“Anyone associated with a business should go to [the LSU Cyber Clinic],” Dwinell-Janopaul added. “They cover so many topics … Stuff that’s really low-cost but makes a huge difference.”

The Best is Yet to Come

The Consortium is proud of the growing impact achieved by the hard working, mission-driven clinics around the world. These metrics provide just a high-level snapshot of the vital work that clinics do every day on the ground to support organizations that are providing critical services to their communities, but rarely have the means to protect themselves in the digital era.

We would like to offer special thanks to the Consortium’s funders, without whom this early vision and growth would not have been possible, including: The William and Flora Hewlett Foundation Cyber Initiative, Craig Newmark Philanthropies, New America’s Public Interest Technology University Network (PIT-UN),  Fidelity Charitable’s Catalyst Fund, Okta, and, in particular, Google.org for their transformational investment in 25 cybersecurity clinics, which helped the Consortium surpass our goal of 25 clinics by 2025.

To sustain and grow this work, clinics rely on both institutional support and philanthropy. We invite you to learn more and support our work by visiting our website: cybersecurityclinics.org.

Together, we can fulfill our founding vision of a cybersecurity clinic in every U.S. state by 2030, and continue to grow the clinic model worldwide.

Thank you for being a part of our journey.

On April 24, 2025, the Consortium of Cybersecurity Clinics held the Spring 2025 “Clinic of Clinics” event, bringing together over 140 students from more than 40 Cybersecurity Clinics across the world. This is a biannual event held each semester and gives students who are working in their school’s  cybersecurity clinic a chance to connect with peers and learn from top experts in the field.

The Consortium of Cybersecurity Clinics is a collaborative network of higher education-based cybersecurity clinics focused on serving community organizations. The Consortium plays a key role in connecting these clinics, sharing resources, and assessing the impact of clinics on students and the communities they serve.

General (Ret.) Paul M. Nakasone

The highlight of the event was a keynote by General (Ret.) Paul M. Nakasone, who led as the former Director of the National Security Agency (NSA) and Commander at U.S. Cyber Command. He is now the founding director of Vanderbilt University’s Institute for National Security.

Inside the NSA and U.S. Cyber Command

General Nakasone started the keynote with a powerful and inspiring statement for the students in attendance, “The future is about talent, and you represent that talent.” He then shared his experiences in the former roles at the National Security Agency (NSA) and U.S. Cyber Command, two organizations that play a very crucial role in securing the nation’s digital infrastructure. He explained the simple yet powerful mission of the NSA: “We make code, and we break code.” The NSA develops cryptographic keys, codes, and encryption technologies in order to protect the country’s most sensitive communications and defense platforms. NSA also plays a critical role in national intelligence by monitoring adversarial activity.

As for U.S. Cyber Command, General Nakasone outlined three core missions:

1. Defending Department of Defense networks, data, and weapon systems: Supporting over 4.5 million users and maintaining constant mobility, this infrastructure serves as the foundation for global military operations.
2. Providing cyber support to U.S. forces deployed worldwide: From Korea to Iraq and Afghanistan, Cyber Command maintains cyber readiness and protection in active military environments.
3. Protecting the nation in cyberspace: Cyber Command works with the Department of Homeland Security (DHS), the FBI, and the private sector to protect US elections and other critical democratic functions from foreign interference.

Disruptive Technologies and the Importance of Adaptation

The keynote was structured with three core themes: disruptive technologies, the current state of cybersecurity, and the skill sets needed for tomorrow’s leaders. To demonstrate the impact of disruptive technologies, General Nakasone talked about Steve Jobs’ 2007 announcement of the iPhone, which he described as “the most disruptive technology of the 21st century.” He compared the companies that embraced the adoption of and adaptation to mobile innovation, like Amazon and Google, with those that ignored the shift, such as Blockbuster, Blackberry, and Nokia. Through this comparison, he explained how early action can shape long-term relevance and success for companies in a world with rapidly evolving technologies, “You can adopt, adapt, or avoid. Choose wisely.”

Artificial Intelligence: Promise and Risk

General Nakasone explained how today’s biggest disruptive technology, Artificial Intelligence, presents both huge opportunities and serious concerns. He then reflected on the launch of ChatGPT, noting its quick growth: over 1 million users in just five days, and 100 million within two months—a pace that significantly exceeded the internet’s initial expansion, which took seven years to reach 50 million users. He called the capabilities of current AI models as “truly outstanding,” citing their quick developments in areas like coding, reasoning, deep research, and even image generation. While he found the new technology to be exciting, he highlighted the need for responsible advancement and called for national investment in talent, energy, compute, chips, and data that would ensure the safe development and application of AI. With regard to cybersecurity, he mentioned several concerns, including the emergence of deepfakes. Fortunately, defense against malicious deepfakes outperformed offense in the 2024 U.S. presidential election.  Additionally, he expressed worries about the possibility of backdoors in open-source AI models, a recent example would be DeepSeek, and the danger of data poisoning during AI model training, vulnerabilities that may be used to infiltrate critical systems. Despite these risks, he maintained his optimism that AI would advance industries like national defense, education, and medicine, stating that the technology has him “riveted on the future.”

The Geopolitical Landscape: Three Arcs of Global Security

Shifting to a broader strategic view, General Nakasone defined today’s global security environment through what he described as three arcs of geopolitics. In the first arc, he explained the rise of China, showing how it went from a $114 billion economy in 1972 to a $17 trillion global power with expanding diplomatic, informational, and military influence today. The second arc focused on active conflicts, such as the Russia-Ukraine War, and ongoing instability in the Middle East. He explained how digital capabilities, like laptops connected through satellite internet, have made it possible for unprecedented disruption, pointing out that Ukraine has disabled more than half of Russia’s Black Sea Fleet despite having no navy. “This is the future of conflict,” he said, where non-kinetic cyber operations increasingly shape kinetic outcomes. The third arc addressed the threats that cross borders, such as pandemics, climate change, and cybersecurity itself, reminding us all that geographic boundaries no longer protect countries from cyberattacks. When combined, these three arcs show how intricately cyberspace has woven itself into both national security and international relations.

A Closer Look at Today’s Cybersecurity Threats

General Nakasone also talked about the current cybersecurity threats. Last year, there were over 5,000 recorded ransomware attacks in the United States, which is a 15% increase from the prior year. He shared that when companies like Microsoft release updates, the attackers are able to exploit vulnerabilities within just five days, putting intense pressure on organizations to patch systems quickly. What’s even more concerning is that it takes an average of 194 days to detect an intrusion and 58 days to remove it. These three elements present a very challenging picture as we think about cybersecurity today and into the future.

The Four Basics That Defeat 96% of Threats

To tackle these challenges, General Nakasone stressed the importance of renewed commitment to “defense in depth,” urging cybersecurity experts to actively look for threats, conduct penetration tests, and prioritize patching. He also shared the four simple practices that can provide protection against 96% of known adversaries. Those four practices are:

1. Keeping the systems updated.
2. Using strong passwords
3. Recognizing phishing attempts
4. Enabling multi-factor authentication (MFA)

What Makes a Great Cybersecurity Leader?

General Nakasone concluded his presentation by outlining the three traits a cybersecurity professional must have: 

1. Critical thinking
2. Communication skills
3. Character

He shared about this experience about how no one asked him what he majored in after college. Instead, they wanted to see if he could break down a complex problem, communicate clearly, and hold strong values. “Character,” he said, “is what you are in the dark. It’s what you stand for when no one’s watching.”

Q&A Session

After the keynote, students from clinics across the world got the chance to ask questions directly to General Nakasone. The Q&A session turned out to be one of the most captivating parts of the event, with questions ranging from privacy and national security to AI regulation, policy and career advice.

Key Takeaways from the Q&A Session:

1. Collaboration is key: Effective cybersecurity requires coordination between the government, the private sector, and academia. Each brings together strengths to solve complex challenges.
2. Technical leaders are in demand: “We need leaders who code, and coders who can lead.”
3. Strategic government investment in education, talent, and infrastructure can drive innovation, just as it did with the interstate highway system and GPS.

Breakout Sessions: Peer Connections and Takeaways

After the conclusion of the keynote and Q&A, the students were moved to breakout rooms, where they discussed engaging prompts. These sessions allowed everyone to make personal connections, share stories, and think about their clinic work from a new perspective.

Final Reflections

The Spring 2025 “Clinic of Clinics” was an insightful event where students connected with each other and learned how cybersecurity relies on people driven by shared values, teamwork, and a desire to learn. General Nakasone’s keynote shed light on today’s most critical challenges and sparked inspiration about the future we’re creating together. In his closing remarks, he quoted Steve Jobs, “Everyone here has a sense that right now is one of the moments that we are influencing the future.” 

Listening to his keynote certainly made us all feel we were in one.