Cybersecurity clinics — university-based programs that train students to provide pro bono cybersecurity assistance to organizations with limited resources — are expanding across the nation and around the world. Clinics equip students with real-world experience as they help local nonprofits, small businesses, and governments defend against cyber threats.
The clinic model gained momentum in 2021 with the launch of the Consortium of Cybersecurity Clinics, a collaborative effort launched by UC Berkeley, MIT, Indiana University, and the University of Alabama. What began as a small network for clinic leaders to share ideas and best practices has evolved into a growing international alliance bolstered by higher ed, philanthropists, and industry, signaling a global shift toward hands-on cybersecurity education in service to the public good.
The Consortium of Cybersecurity Clinics has experienced unprecedented growth over the past year. With many new clinics launching and existing programs expanding, the 2024-25 academic year has been the Consortium’s largest period of growth since our founding in 2021:
- 56 total member clinics have joined the Consortium, with 41 U.S. clinics in 27 states and the District of Columbia.
- Global expansion in North America, Europe, Asia, and South America, with first-in-country clinics launched in Canada, Peru, Sri Lanka, and Pakistan — plus the Consortium’s first-ever high school-level clinics in Arizona.
- Member clinics trained more than 2,200 students and provided cybersecurity services to over 700 clients.
As our members kick off the Fall 2025 term, we are proud to reflect on their accomplishments and highlight just how significant a leap forward this past year has been. The metrics shared below are aggregated from data provided by 39 of our member clinics.
Multiplying our Alumni Base
Cybersecurity clinics serve a dual purpose: they provide pro bono cybersecurity services to under-resourced community organizations and train the next generation of cybersecurity professionals. By supporting real-world clients, clinic students gain hands-on experience and develop the depth of technical knowledge and breadth of professional skills needed to meet the unique and evolving cybersecurity challenges of community organizations. Students in these programs are being trained at a rate not yet seen before: in the 2024-25 academic year alone, 39 clinics reported training a total of 2238 students — more than double the cumulative total of clinic alumni between Fall 2018 and Spring 2024.
Impact Spotlight: Student Testimonial
“Participating in the Cyber Clinic at Old Dominion University wasn’t just an internship — it was a transformational experience that completely reshaped how I approach cybersecurity.
From day one, I realized this program was different. It blended technical knowledge with communication, professionalism, empathy, and real-world problem-solving. This internship sharpened so many of my skills: technical, analytical, writing, communication, and perhaps most importantly, my ability to empathize and consult like a professional.”
– Carla Belfiore, Student Intern, Old Dominion University,
Coastal Virginia Center for Center Innovation (COVA CCI) Cybersecurity Clinic
Global Growth
This year, the Consortium welcomed new clinics at universities in Southeast Asia, Central Asia, and South America. In Taiwan, our partners at the National Institute of Cyber Security (NICS) have used Consortium support and resources to launch cybersecurity clinics at 10 universities across the country — reaching urban centers as well as more rural communities in northern, central, southern, and eastern Taiwan.
In their first year of operation, the Sri Lanka Institute of Information Technology (SLIIT) trained 176 students and provided services to 44 micro, small, and medium enterprises (MSMEs) in Sri Lanka. Their Program Coordinator, Kavinga Yapa, shared, “The success of our first year demonstrates the real-world value of the cybersecurity clinics model. By engaging both students and MSMEs, we have been able to bridge academia with community needs. Students gained hands-on experience applying structured risk assessment frameworks, while MSMEs received practical guidance to strengthen their security posture. We are proud that SLIIT has emerged as the first university in South Asia to join the Consortium of Cybersecurity Clinics, and we look forward to expanding this impact further with continuous support and collaboration.”
Impact Spotlight: Securing Small Critical Infrastructure
The San Diego Cyber Clinic, a collaboration between San Diego Cyber Center of Excellence (CCOE), California State University San Marcos (CSUSM), National University and San Diego State University (SDSU)
Last year, a team of five students from the San Diego Cyber Clinic completed a cybersecurity assessment for a local Municipal Water District. The engagement encompassed a range of activities to strengthen the security of the district, including social engineering exercises, penetration testing, and a targeted phishing campaign to evaluate and build staff awareness.
When asked about the project outcomes, Lisa Easterly, President & CEO of CCOE, shared, “In addition to identifying vulnerabilities, the students developed essential documentation to support the district’s cybersecurity posture, including an Incident Response Plan, Disaster Recovery Plan, and Business Continuity Plan. By integrating these components, the project not only uncovered risks, but also provided a roadmap for the district to enhance its resilience against cyber threats.”
Scaling Services for Community Organizations
In addition to providing students with skills-based, experiential learning, clinics serve as a vital local resource for strengthening community cybersecurity. The Consortium’s member clinics support community organizations with foundational cybersecurity services, including risk assessments, policy development, and training that they would otherwise struggle to access.
In our Growth and Impact blog post from March 2024, we proudly shared that our clinics had served a total of 83 resource-strapped client organizations. Remarkably, in the last year alone, the Consortium’s member clinics served 713 community organizations, dramatically growing the volume of clients benefiting from pro bono clinical services in the U.S. and around the world.
Clinics support a wide range of community organizations, with some focusing on specific types of clients. For example, the DePaul Cybersecurity Clinic works exclusively with community-based nonprofits in the Chicago area. Looking at data from 82% of last year’s clinic clients:
- Small critical infrastructure entities — such as utilities, state and local governments, healthcare providers, and K-12 schools — made up 47.5% of the total.
- Small businesses were the next largest group at 30.4%.
- Nonprofits followed at 17.3%.
Impact Spotlight: Client Testimonial
Louisiana State University Cyber Clinic directed by Professor Aisha Ali-Gombe
When Permanent Coatings, a family-owned industrial paint maker in Denham Springs, Louisiana, sought to strengthen its cybersecurity posture, it turned to the Louisiana State University (LSU) Cyber Clinic, which specializes in assisting local small businesses. After attending several LSU Cyber Clinic seminars hosted in partnership with the Louisiana Small Business Development Center, Operations Manager Luke Dwinell-Janopaul requested a personalized consultation from the clinic.
“I think the biggest part has just been the knowledge that the Cyber Clinic has given us, which is half the battle when it comes to cybersecurity,” he said. With guidance from the clinic, the company updated its backup practices, secured physical and digital ports, and built defenses against their biggest threat: social engineering attacks.”
“Anyone associated with a business should go to [the LSU Cyber Clinic],” Dwinell-Janopaul added. “They cover so many topics … Stuff that’s really low-cost but makes a huge difference.”
The Best is Yet to Come
The Consortium is proud of the growing impact achieved by the hard working, mission-driven clinics around the world. These metrics provide just a high-level snapshot of the vital work that clinics do every day on the ground to support organizations that are providing critical services to their communities, but rarely have the means to protect themselves in the digital era.
We would like to offer special thanks to the Consortium’s funders, without whom this early vision and growth would not have been possible, including: The William and Flora Hewlett Foundation Cyber Initiative, Craig Newmark Philanthropies, New America’s Public Interest Technology University Network (PIT-UN), Fidelity Charitable’s Catalyst Fund, Okta, and, in particular, Google.org for their transformational investment in 25 cybersecurity clinics, which helped the Consortium surpass our goal of 25 clinics by 2025.
To sustain and grow this work, clinics rely on both institutional support and philanthropy. We invite you to learn more and support our work by visiting our website: cybersecurityclinics.org.
Together, we can fulfill our founding vision of a cybersecurity clinic in every U.S. state by 2030, and continue to grow the clinic model worldwide.
Thank you for being a part of our journey.
