Resources

Field guides, analysis, and templates for higher-education cybersecurity

Practical content from Synaptic Cyber on higher-education cybersecurity, compliance, IT operations, AI governance, and vendor risk — written for working CIOs, CISOs, architects, and engineers at colleges, universities, and research institutions.

Current events

Supply Chain Attacks Are Not Just a Code Problem

After years of treating software supply chain risk as a problem of vulnerable packages and dependency hygiene, the last round of attacks should make it clear that those things are not the whole problem — and in some cases not even the main one. The deeper issue is trust: whether we can actually verify what we're about to run, and whether the systems making those trust decisions are themselves overprivileged and one compromise away from becoming the next incident.

April 4, 2026Harry Hoffman

Field guide

Choosing Software Is About to Become a Whole Lot Harder

The signals we relied on to evaluate software — polish, code volume, evident effort — are about to become unreliable. When a single developer can scaffold a convincing system in hours, the appearance of maturity stops telling us anything about whether the underlying architecture, security, or operational discipline will hold up. Here's how to evaluate software when surface signals can't be trusted.

March 14, 2026Harry Hoffman

Field guide

What Boards Really Need to See in Security Metrics

One of the biggest mistakes in security reporting is throwing too much noise at the Board. Vulnerability counts and patch percentages matter operationally, but they don't help directors make decisions. A practitioner's view of the metrics that connect cybersecurity to what Boards actually care about — risk, finances, reputation, and strategy — with a higher-education-specific addendum.

August 18, 2025Harry Hoffman

Field guide

GLBA Safeguards Rule for Higher Ed: A Field Guide for CISOs

The FTC's June 2023 amendments turned the GLBA Safeguards Rule from a long-ignored Title IV obligation into an enforceable security program with real teeth. A practitioner's guide to what changed, why higher-ed is uniquely exposed, what each of the nine required program elements actually means for a college or university, and what an audit-ready Information Security Program looks like.

June 9, 2025Harry Hoffman