The National Institute of Standards and Technology (NIST) recently hosted a webinar on university-based cybersecurity clinics and their role in strengthening small businesses’ cybersecurity resilience while training the future workforce. The event featured two Consortium members, Louisiana State University (LSU) Cybersecurity Clinic and University of Nevada, Las Vegas (UNLV) Cyber Clinic, highlighting not only how cybersecurity clinics operate but also the experiences of the small businesses and students who participate in them. While this webinar focused on clinics working with small businesses, cybersecurity clinics serve a wide range of clients, including nonprofits, municipalities, rural school districts, and other under-resourced organizations. 

The full video for this webinar can be found on NIST’s website here.

Why Cybersecurity Clinics Matter

Cybersecurity clinics help address two key challenges:

1. Providing cybersecurity support to under-resourced organizations that have limited access to cybersecurity services and expertise.
2. Training students through real-world client work, preparing them for careers in cybersecurity with on-demand skills and practical experience, while reinforcing commitment to public service.

Rodney Petersen, Director of NICE (National Initiative for Cybersecurity Education), emphasized how clinics bridge the cybersecurity skills gap while expanding access to security services for small businesses that often cannot afford them.

Clinic Spotlights: LSU and UNLV

LSU Cybersecurity Clinic: Leveraging Community Partnerships to Reach Local Businesses

Dr. Aisha Ali-Gombe, Director of the LSU Cybersecurity Clinic, shared how LSU’s model provides students with structured, hands-on experience while offering small businesses three core services:

• Training & Seminars – Broad educational sessions on cybersecurity best practices.
• One-on-One Counseling – Advisory sessions tailored to each business’s needs.
• Comprehensive Cybersecurity Assessments – Detailed evaluations of security posture, led by students under faculty supervision.

By partnering with the Louisiana Small Business Development Center (LSBDC), LSU ensures its clinic reaches businesses that need cybersecurity support but lack the resources to hire professionals. Many business owners are unaware of how vulnerable they are, an issue LSU’s clinic helps address.

One of LSU’s clients, Gary Anderson of Cardinal Capital, LLC, shared how his company was unsure of its cybersecurity risks until engaging with the LSU Cybersecurity Clinic. Anderson described how working with LSU students helped his company identify key security gaps, strengthen internal security policies, and implement real-world solutions that made a tangible impact. Anderson also provided a glowing recommendation for LSU’s clinic and its students, mentioning their professionalism, competence, and ability to deliver on their promises.

UNLV Cyber Clinic: A Student-Led Business Model

Mehdi Abid, Cyber Program Coordinator at UNLV, described their clinic’s student-driven approach, where students recruit their own clients, manage services, and conduct assessments. The clinic operates like a small cybersecurity consulting firm, giving students hands-on experience in client relations, project management, and technical security work.

UNLV emphasizes that cybersecurity isn’t just technical—it requires strong communication and problem-solving skills. Students learn to:

• Engage small business clients and tailor security solutions to their needs.
• Develop leadership and teamwork skills while managing client projects.
• Apply classroom knowledge in a real-world setting to better prepare for cybersecurity careers.

UNLV student Keith Daniel Tan spoke about his experience working with small businesses through the clinic, highlighting how real client interactions strengthened his cybersecurity skills. He emphasized that while technical knowledge is critical, learning to communicate cybersecurity risks effectively was one of the most valuable takeaways. His experience working directly with business owners provided him with a stronger professional skill set and helped solidify his career goals in cybersecurity consulting.

Key Takeaways

Small Businesses Need More Than Just Technical Support

• Many small businesses do not recognize their cybersecurity risks until they experience a breach or incident. Clinics play a key role in bridging this awareness gap.
• Effective outreach—through partnerships like LSU’s collaboration with LSBDC or UNLV’s student-led client engagement model—ensures that small businesses know help is available.

No Single Model for Assessments

• Clinics design their own assessment frameworks based on student skills, client types and needs, and available resources.
• Some clinics conduct penetration testing and in-depth risk assessments, while others focus more on security policy, governance, and fundamental cyber hygiene.

Hands-On Learning with Real-World Impact

• Students gain practical experience that strengthens their employability, while businesses receive security services they couldn’t otherwise afford.
• Hearing directly from students and clients in this webinar underscored the value clinics provide—not just as a training ground for students, but also as a meaningful cybersecurity resource for communities.

Legal and Ethical Considerations
Cybersecurity clinics work closely with their institutions and clients to align on expectations and to develop safe and ethical structures for students to work with real-world organizations. These relationships are often supported by:

• Legal and operational frameworks such as NDAs, MOUs, and Student Codes of Conduct to ensure confidentiality, shared expectations, and ethical practices.
• Creative engagement models such as:
  • Students being hired by clients as interns, ensuring proper oversight and structured learning.
  • Clinics partnering with local Small Business Development Centers (SBDCs), which manage the client relationship and legal liability while providing cybersecurity services via the clinic as part of their broader support offerings.

Conclusion

This webinar reinforced the critical role cybersecurity clinics play in both workforce development and providing cybersecurity services to local small businesses. As more universities launch clinics, LSU and UNLV’s models offer valuable lessons on structuring programs, engaging students, and delivering meaningful security support to small businesses.

For more information about cybersecurity clinics and how to connect with one, visit the Consortium’s website.

Watch a replay of the webinar below.

On November 11, 2024, the Consortium of Cybersecurity Clinics hosted 66 students representing 14 different universities for the Fall 2024 “Clinic of Clinics,” a semesterly event for students participating in clinics to network, learn from experts in the field, and partake in group activities. 

Matthew Nagamine, the Director of Membership of the Consortium, began the online meeting by emphasizing how the event served as a way for clinic students from all over the country to meet peers, including some who might end up as colleagues in the future. 

In a lighthearted icebreaker, students were asked to introduce themselves in the chat using only emojis. This engaging start set a collaborative and communicative tone for the event. 

A highlight of the event was a keynote by Dr. Jeff Tully, who leads the Healthcare Ransomware Resiliency and Response Program at the UC San Diego Center for Healthcare Cybersecurity. Tully provided a compelling overview of the intersection between healthcare and cybersecurity, and gave insights into the consequences of cyber threats on patient health care and hospital operations. 

In his presentation, Tully shared that cyber attacks on healthcare are growing, and it is affecting and degrading hospitals’ ability to perform operations. Not only is this a point of weakness of critical infrastructure from the perspective of national security, but it also worsens disparity in health care. At the granular level, it can also impact individuals and families in devastating ways. Tully shared an example of an incident at a hospital in Alabama, where a nine-month old baby passed away. The child’s mother claims this to be the result of diminished care due to a malfunctioning computer system during a cyber attack that was not disclosed. 

Ransomware attacks, in addition to impacting patient care and the ability to provide medical care, also impacts patient health information, as stolen data often ends up leaked. The financial impacts can also be very costly; for example, Tully cited a cyberattack that cost Scripps approximately $113 million dollars in lost revenue. 

With all these concerns, how do you study a problem like this? 

Dr. Tully highlighted how we can apply the scientific method to the field of cybersecurity by asking questions and performing experiments. He explained how early medicine relied on trial and error, but evolved into a data-driven discipline through scientific research and hypothesis testing. 

For example, one of the challenges of studying a ransomware attack to see if it disrupts patient care is that organizations are not eager to show everything that went wrong. However, rather than study the direct data, one of Tully’s suggestions was to study the ripple effects. When hospitals are attacked by ransomware, they attempt to stem the damage by shutting down the network and locking down services, and hospitals that cannot take patients may send them to nearby hospitals. Rather than focusing solely on IT systems, researchers could examine impacts such as patient health outcomes, emergency diversion rates, and operational disruptions, before, after, and during a cyberattack. 

“We could be doing more of these scientific studies with respect to these cybersecurity practices,” Tully said. Sharing an example of this, Tully shared the results of a phishing study, in which a test group that underwent phishing training did not have any significant impact on the group’s vulnerability to phishing attacks. 

Tully also shared innovative tools and solutions to mitigate the effects of cyberattacks on healthcare operations. For example, detecting when ransomware attacks are occurring may be possible by using publicly accessible information. Hospitals are usually very noisy on the internet, so if they shut down, they suddenly become very quiet. If signals of network activity go away, it can be an indicator that something may be occurring. 

Inspired by military technology, Tully also proposed using rapidly deployable 5G networks and point-to-point Wi-FI systems to ensure that hospitals can continue to function even when their primary networks are compromised. 

In closing, Dr. Tully shared advice for students. He encouraged them to think creatively and embrace diverse opportunities in cybersecurity, noting that the field is open to those with a variety of skill sets and backgrounds. He remarked, “[it is] important to understand what happens when we fail, and how to fail better, rather than how to avoid failure at all.”

Following the keynote, students came together in breakout rooms to share their unique journeys and aspirations in cybersecurity. Reinforcing the advice that Dr. Tully imparted, students met peers of all different backgrounds; the meetings brought together graduate and undergraduate students, as well as students from different universities. For example, in one breakout session, there were Computer Science, Management and Information Systems, and English majors, as well as students with military and animation backgrounds. Some were interested in how cybersecurity work is done for the government, while others were interested in malware analysis. Students also shared how their university runs the clinic program and imparted advice based on their experience. 

The Consortium’s Fall 2024 Clinic of Clinics demonstrated the spirit of collaboration and innovation. As cybersecurity challenges evolve, events like these are helping to empower the next generation of cyberdefenders. 

The Consortium of Cybersecurity Clinics mourns the profound loss on October 5 of Dr. Kevin Harris, a dedicated leader and advocate who helped shepherd our community beginning in May 2022. Kevin’s commitment to diversity and inclusion in cybersecurity education leaves a lasting legacy within the Consortium.

While his work for cybersecurity clinics was just part of his broader leadership in the community, we want to share a window into what he meant to those who knew him as a friend and colleague in the Consortium.

Kevin was a trailblazer when he launched a cybersecurity clinic at Stillman College, the first Historically Black College or University (HBCU) to adopt the clinic model. Under his leadership, the DEI Cybersecurity Clinic at Stillman focused on building a diverse pipeline into the workforce and supporting underserved small- to mid-sized, minority-owned organizations. 

His vision and commitment to creating new opportunities for historically underrepresented communities resonated deeply with the Consortium’s mission. His message to other HBCUs was simple yet powerful: “If we could do it at Stillman, you can do it, too.”

Kevin quickly became a mentor for smaller schools, liberal arts programs, and minority-serving institutions, especially HBCUs, seeking to start clinics. He served as a spokesperson on the Consortium’s “What is a Cybersecurity Clinic?” video, helped lead our first Cyber Clinics Training Workshop, and served on the Consortium’s Clinics Fundraising Subcommittee. 

“Kevin Harris joined the Consortium when it included only a handful of university-based cybersecurity clinics, and he was instrumental in shaping the Consortium’s mission and values,” said Ann Cleaveland, Co-Chair of the Consortium. “He will be remembered for many things, but most of all for giving his time so generously to inspire and advocate for under-represented students and client organizations to engage in community-based cybersecurity.”

“Dr. Harris played a pivotal role in Google’s decision to provide $500,000 to Stillman College in support of the first cybersecurity clinic at an HBCU,” said Maab Ibrahim, Cybersecurity Lead at Google.org, Google’s philanthropy. “His leadership inspired and facilitated our funding for additional clinics at Minority-Serving Institutions across the Consortium, which now includes four other HBCUs, as well as tribal and women-serving colleges — a legacy that will forever honor his memory.” 

Dr. Harris was dedicated to building a more inclusive field and boosting HBCUs as marquee cybersecurity training institutions. At the time of his passing, he was creating a community of practice within the Consortium for HBCUs to meet and share best practices, just a year after launching Stillman’s own clinic.

Ameerreia Campbell was one among many students at Stillman who participated in the clinic and benefitted from Kevin’s mentorship and guidance. “Without Dr. Harris’ influence I would never have been exposed to the opportunities and the great community in cybersecurity that I’ve been blessed to experience because of his generosity,” Campbell says. “I will never forget speaking at the Cyber Civil Defense Summit this past summer because he challenged me to take on that opportunity, or all the ways he guided me and other students to grow and develop under his mentorship.” 

We invite you to watch the “What is a Cybersecurity Clinic?” video, learn more about the HBCU Cybersecurity Clinic Center, read the Forbes article on Kevin’s work at Stillman College, and read a Q&A with Kevin, as featured by the Public Interest Technology University Network (PIT-UN).  

The Consortium’s leadership team and member institutions have been blessed to work with Dr. Harris over the years, and more so to call him a dear friend. He will continue to inspire our members, students, and clients for years to come.

An obituary and guestbook to record reflections and memories on Dr. Harris is available at https://www.newgenerationfh.com/obituary/kevin-harris.

More than 30 individuals affiliated with the Consortium of Cybersecurity Clinics attended the June 2024 Cyber Civil Defense Summit in Washington D.C., joining more than 150 additional cyber defenders, academics, and policymakers who share a mission of protecting under-resourced community organizations against cybersecurity threats. This was the second convening of the day-long annual conference — orchestrated by the UC Berkeley Center for Long-Term Cybersecurity (CLTC), which co-founded and co-chairs the Consortium, and made possible with a grant from Craig Newmark Philanthropies. 

Consortium representatives engaged throughout the robust agenda, scoped under the theme “Data Driven Resilience.” The Summit’s panels and presentations surfaced a range of valuable insights, including how volunteer-based programs like cybersecurity clinics are essential — but more must be done to provide incentives and fill the talent pipeline. 

Read more takeaways from the Summit on the CLTC website:
https://cltc.berkeley.edu/2024/07/18/eight-key-takeaways-from-the-cyber-civil-defense-summit/

Want to start a clinic? Check our our resources and learn more about our community of 33 (and counting!) members. 

The Consortium of Cybersecurity Clinics is pleased to announce that Matthew Nagamine will serve as Membership Director, responsible for developing and implementing strategic priorities for the Consortium, onboarding and stewarding member clinics, and working with Consortium leadership to achieve its mission of launching a university, college, or community-college based clinic in all 50 U.S. states by 2030. 

We sat down with Matt to learn more about his background, what he’s most looking forward to in his new role, and his vision for the Consortium.

Matt Nagamine has been CLTC’s Manager of Strategic Partnerships since 2018, where he has cultivated impactful relationships with key partners and allies to support CLTC’s programs. During his tenure Matt has managed multiple flagship projects including Cybersecurity Futures 2030 and CLTC’s Research Grants Program. In early 2021, Matt played a key role in getting the Consortium of Cybersecurity Clinics up and running. He researched and built the first backend systems for the Consortium, set-up monthly meetings, managed an RFP for Members, administered grants, and helped with the first Clinic of Clinics student networking event. Matt also co-led the creation and implementation of CLTC’s Diversity, Equity, Inclusion and Belonging strategic plan.

Matt earned his bachelor’s degree in Political Science with a minor in African American Studies from UC Berkeley, where he conducted research in Professor Nikki Jones’ Justice Interactions Lab, exploring the intersections of race, gender, and justice.

---

What attracted you to the Consortium’s mission?

What’s not to love? The Consortium’s purpose is to support a network of colleges and universities in building and growing cybersecurity clinics. These clinics educate and train students for the cybersecurity workforce while helping protect vulnerable organizations from cyber attacks. I was fortunate to contribute to the Consortium in 2018 by building the first back-end systems, setting up the first monthly meetings, facilitating an RFP that administered the Consortium’s first grants to members. Since then, I’ve had a front row seat observing how the Consortium has made clinics more effective by facilitating information sharing among members—and how making this knowledge accessible to others has significantly lowered the barriers for more universities to establish clinics of their own.

What will you be doing as Membership Director? What do you hope to achieve in the role?

In recent months, the Consortium has experienced a tremendous amount of growth, with new members in many states, major investments from funders, and increased visibility at the NICE cybersecurity conference and Cyber Civil Defense Summit. The Consortium now needs full-time support from someone who can provide leadership, structure, and organization for its members. As the Membership Director, I aim to drive both short- and long-term strategies that will significantly enhance the membership experience and the Consortium’s ability to support clinics in delivering high-quality training for students and services for their clients.

What aspects of the role most excite you?

I am most excited to meet, support, and work alongside this incredible group of cyber civil defenders. The Consortium and its members—an impressive and diverse network of academic institutions, including community colleges, Minority Serving Institutions (MSIs), tribal colleges, and international universities—are already doing amazing work. I’m fired up about helping these members become better connected and more effective through their membership.

Clinics are often championed for helping defend “civil society” and to grow and diversify the cyber workforce – why is this important, broadly, and to you personally?

This model addresses two major gaps in the cybersecurity field: 1) helping low-resource or otherwise vulnerable organizations that are providing crucial services to their communities to improve their cybersecurity posture with no-cost, direct assistance; and 2) equipping students, including many traditionally under-represented in the field of cybersecurity, with practical skills and real-world experiences that are transferable to the cybersecurity job market. Filling these gaps is crucial to achieving more secure and more equitable cybersecurity outcomes for everyone. I believe in and am excited to contribute to the grassroots, community-based approaches that Consortium members take to expand who participates in and has access to cybersecurity.

What’s something you want the Consortium of Cybersecurity Clinics community to know about you?

Last year, I led CLTC’s Cybersecurity Futures 2030 initiative, in partnership with the World Economic Forum’s Centre for Cybersecurity, which gathered global perspectives on how cybersecurity will evolve by 2030, providing decision-makers with strategic foresight to improve the decisions they make today. Through this work, I truly understood the importance of incorporating diverse perspectives to understand and solve issues. This experience reinforced my commitment to inclusive practices and to cybersecurity on a global scale.

What have you learned from working in the cybersecurity field that you’ll take with you?

Relationships and collaboration have been at the core of my work managing strategic partnerships at the UC Berkeley Center for Long-Term Cybersecurity (CLTC). I’ve learned that the most complex challenges in cybersecurity often can only be addressed through strong, trustworthy partnerships. I think this is true for Consortium members and the student and client communities they serve. These lessons will guide me in my role as Membership Director, helping to support our members and advance our mission.