AI, Identity, and Speed: Cybersecurity Priorities for Higher Ed
Fortinet Security Operations Specialist Jason Palm explains how higher education's rapid adoption of AI raises governance, access control, and acceptable-use questions, while attackers are also using AI to accelerate reconnaissance, credential abuse, brute force, phishing, and other activity, compressing the time to exploit known exposures. He notes the scale and diversity of university environments make them prime targets for social engineering and identity compromise, citing FortiRecon observations of 4.6 billion stealer logs shared on the dark web. Palm advocates a platform approach with AI-enabled integrations and agents to boost analyst productivity, automate mundane L1 triage, and enable proactive threat hunting. He outlines a six-item checklist: Know your exposure via CTEM, harden identity with strong MFA, patch faster as exploitation windows shrink to 24–48 hours, modernize detections through signal correlation, automate response to reduce MTTD/MTTR, and prepare for impact with tested incident response plans, exercises, resilient backups, and an IR retainer.
00:00 Meet Jason Palm
01:02 AI Adoption in Education
01:47 Attackers Using AI
03:13 Identity as the Battleground
04:32 Defending with AI Platforms
05:14 AI for Analyst Efficiency
07:13 Checklist Know Your Exposure
08:34 Harden Identity and Patch Fast
10:34 Modernize Detection and Response
11:59 Prepare for Impact Events
Additional resources:
Sponsored by Fortinet
Transcript
Jason Palm 00:08
My name is Jason Palm. I work with Fortinet. I myself am a security operations specialist, and I've been with Fortinet for four years. Prior to that, I spent many years with a managed service provider, where I started and ran their managed detection and response team, and also their penetration testing team. Now with Fortinet as a SecOps specialist, really what we're doing is focusing on organizations of all sizes to help them protect their users, their applications, data, networks, you name it. We're a full shop security provider, and we are working with customers of all shapes and sizes, whether that's enterprise or higher education, to implement defenses across the board to make sure that their security operations are as simple as possible at times, but still as robust as possible.
How is AI adoption impacting cybersecurity for higher ed institutions?
Jason Palm 01:02
I would say that there's two courses or two schools of thought to consider. One is the fact that colleges, universities are adopting AI really across the board, right? Whether that's for teaching, research, day-to-day operations, things like student services, and of course productivity. So this does create questions around things like data governance, access control, privacy, acceptable use, and how some of the sensitive information that institutional knowledge or research data is handled. So on that front, I would say that higher education needs to consider these things and wrap policies around those things. The other side of the coin is what attackers are doing, and it's really the crux of what we're discussing at Fortinet these days. So obviously, attackers are also using AI, and then our Global Threat Report, for example, highlights how AI-enabled offensive tools are being used to do things like accelerate reconnaissance, credential abuse, brute force attacks, phishing, malicious content. It really runs the gamut. Really, AI isn't creating new categories of exposure, I would say, but it's compressing the timeline. The timeline required for attackers to find, validate, and then exploit some of those existing exposures. This then becomes an immediate issue for higher education, just due to the nature of those environments. I talk a lot about the fact that education is really like enterprise environments. They're very large. They consist of a very diverse user base. We're talking about students, faculty, staff, of course, but then you also consider contractors, researchers, even alumni, and then you add in things like third-party partners, right? So all of these groups are interacting with institutional systems, they themselves then become ripe targets for very convincing social engineering, things like phishing, credential attacks. So this understanding then also leads to discussion around identity. For example, our FortiRecon service observed 4.6 billion stealer logs that were traded or shared on the dark, the dark web. So identity compromise remains a major attack vector. For example, I often speak about my previous past as a penetration tester just a few years ago. The vast majority of the wins that we had were through credential compromises. At that time, we were doing a lot of scripting. We were automating a good amount of the process. Now, with all of the AI-amplified attacks, what we're seeing is really just that rapid increase of the ability to exploit things like trust, taking over accounts, sessions, permissions, of course, email, collaboration platforms, and cloud access. So I would say that the big takeaway on that front is the fact that attackers aren't necessarily smarter; they're not necessarily doing new things, but AI is making them a lot faster.
What opportunities do you see for AI to enhance cybersecurity defenses?
Jason Palm 04:32
With Fortinet, what we're seeing with AI capabilities now wrapped into our defense mechanisms is the fact that we are putting these types of tools or these types of capabilities into a platform approach. This is something that I commonly discuss with customers. Instead of looking at maybe single point solutions, right, where this particular tool is going to address this particular problem, is to look at your entire toolset, look at how those things actually interoperate, and then take advantage of the exponential sometimes capabilities that you have through integrations and the use of AI to facilitate the speed at which you can implement or leverage those tools. And even simply things like using AI-based agents to guide analysts, for example. This is one of the biggest things that I'm talking with customers about, is not necessarily being fearful of that this might replace an individual or a specific job role within our organization, but rather taking those skilled individuals and then allowing them to use these AI-based tools to be more productive, to be more efficient at what they're doing. So rather than an analyst maybe reviewing or addressing a handful of alerts throughout the day, now they have the capabilities to leverage integrations within a platform, use these embedded tools, these AI agents, to increase the number of alerts that they're able to review and resolve. And then of course there is the capability to automate a lot of that workload, right? So even from a security operations perspective, if we're talking about someone that's in the, the role of an analyst, they might be doing a lot of tier one or level one alert review and triage, which in a lot of cases is rather mundane. And these are the type of things that often lead to burnout. So one of the biggest benefits that I would say that we're seeing is the ability to actually automate those, to take over the roles of those L1 operations, but then free up your workforce, those analysts, to actually do more rewarding types of activities, right? Things that could even be proactive, things like threat hunting across your environment. So by using these types of tools, these types of capabilities within AI, we can not only increase our speed of detection and response, which is directly correlated to the speed that we're seeing from attackers, but we can actually free up probably what I consider our most valuable resource, which is the people, to do more rewarding tasks and to be more proactive, as I said.
What should colleges prioritize to best protect their environments and prepare for future threats?
Jason Palm 07:13
I typically will boil this down to maybe six items that you could create a checklist around and put those in some kind of priority, prioritization order. The first one is just to know your exposure. So I often cite one of the maxims from Sun Tzu's "The Art of War," which is an ancient Chinese military treatise. But it simply states that you have to know yourself, right? So I find that a lot of institutions, whether that's higher education or even enterprise institutions, because of the complexity, they simply cannot protect what they don't know is exposed. So that becomes the biggest thing: is to know your exposure. At Fortinet, for example, we're constantly now talking to entities about adopting CTEM, which is continuous threat exposure management, really constantly understanding your attack surface. So that's going to include things like cloud posture, remote access, vulnerable systems. Basically, you have to do more than just the traditional vulnerability scan, where maybe on a weekly or monthly basis you scan a bunch of IP addresses, for example, see if there's any vulnerabilities or patch them. Now you should be adopting some kind of continuous, ongoing cycle to assess your attack surface and then address any exposures that you have in real time. The second one that I would put on that list is to harden identity. I mentioned this before when talking about the increase in credential-based attacks that we're seeing. So I'm typically telling colleges, for example, that you should assume that your credentials from your user base or from your systems are already being targeted. They're probably already stolen, and they could be reused, and they're probably even being traded on the dark web, for example. Things like strong multi-factor authentication become a priority. And in many cases, even hearkening back to my previous role as a penetration tester, I talked with customers during debrief sessions that if they had implemented just basic multi-factor authentication, they would have prevented some of the compromises that we were capable of achieving, which also leads into discussions around patching and vulnerability management. Speaking of that FortiGuard Threat Labs report, once again, traditionally what we are seeing is exploitation within maybe a week, that's been compressed down to 24 to 48 hours. So we have to be able to patch as quickly as possible before things can be exploited. So using services like our FortiRecon service, which is going to enrich across different platforms and provide what we call adversary-centric intelligence, which is going to give you context above and beyond just the risk rating for a vulnerability, for example.
Jason Palm 09:59
So, for example, with proactive services like reconnaissance services, we can actually leverage our threat intelligence. We can leverage open source intelligence, technical threat intelligence, to now look at vulnerabilities or exposures, and then give you context. It might be a critical vulnerability, but based on what we're seeing in the wild, for example, it might be low risk. It might be difficult for attackers to exploit, or it might be something that we haven't seen a weaponized exploit for in the wild just yet. All of this then leads into the fourth point, which I would typically tell people is modernizing your detections. When I say modernize, what I mean is you have to be able to correlate across all kinds of different feeds. You know, whether that's endpoint detection, network detection, e-mail, identity, all of the different cloud signals that you bring into an organization. So higher education should be looking at implementing some kind of platform, something that's going to correlate all of these multiple signals, instead of just relying on single points of information from a single tool, for example, and then relying on humans maybe to do some kind of manual correlation or review. So, looking to modernize threat detection in that regard becomes critical. I would also say that one of the key factors or key things that organization, organizations should be looking to implement and rely on is the ability to automate responses where possible. So essentially, security teams should be implementing some kind of response framework, which is going to hopefully meaningfully reduce the time to detect, so MTTD, the mean time to respond, provide containment where necessary, and then even revoke access if we see that a user or system has been compromised in some kind of fashion. And then finally, what I'm talking about with all of my customers, especially with higher education, is that you should prepare for some kind of impact event. A lot of institutions that I speak with don't even have things like an incident response, incident response plan that they've tested. They don't conduct tabletop exercises. They have flat networks. They lack resilient backups. And unfortunately, they have no clear decision-making process when an event occurs. So, I highly recommend that organizations have some kind of incident response retainer at the ready. So, when there is some kind of impactful event, they've already practiced, they've already rehearsed what they need to do next, and then they have a trusted partner in the form of an incident response retainer that's at the ready when one of these events do occur.