Rethinking Data Protection for Universities Built for Collaboration

Universities need contextual data protection that secures research, student records and AI use without obstructing academic collaboration.

• By Zach Lewis, Yonatan Zohar
• September 15, 2026

Universities exist to foster discovery and collaboration between students and faculty, advancing knowledge and driving innovation for the benefit of all. The free exchange of information is arguably the greatest strength of higher education.

With the free flow of information, researchers can collaborate across institutions. Faculty can share ideas, data and their latest findings. Students are then encouraged to explore and question with new information available at their fingertips every day.

Universities break traditional security assumptions. They're designed to be open, collaborative environments where information is meant to move. Most data protection tools were designed for the exact opposite. The result is a constant tug-of-war between security and the mission of the institution. Student records, research data, intellectual property and financial information move across SaaS apps, browsers, endpoints and now AI tools. 

Generative AI is creating new data security challenges for universities at full tilt. The rapid rate of industry adoption increases chances of sensitive information leaking across workflows in unforeseen ways, making it harder for security teams to monitor data movement. As a result, universities become more attractive targets for attackers, as seen in the recent University of Nottingham incident, where vulnerabilities exposed by AI-driven processes were exploited.

Let us be clear: higher education doesn’t have a data protection problem because it lacks controls. It is struggling because traditional controls, which were designed for the Stone Age, haven’t evolved to accommodate the way universities actually operate.

Security teams don't need more alerts telling them data moved. They need context that tells them whether that movement is normal, risky or a problem worth investigating.

Why Traditional Data Protection Programs Fall Short 

University security leaders seek out data loss prevention (DLP) tools with the intention of understanding what data they have, who has access to it and how it is used and moved. Legacy DLP tools often rely on rules to sift through any data activity. The lackluster, outdated approach, which used to work in stagnant, standard corporate environments before the cloud (yes, that long ago), has always struggled in higher education environments where information sharing is part of operations. 

For example, if University A has a staff member suddenly sharing large amounts of research information with people outside the university, that may be flagged as suspicious. However, it could easily be innocuous for a specific project. 

DLP tools also typically adhere to standard compliance regulations, but this can become muddled in the university context. If a student shares exam questions, it could be a Family Educational Rights and Privacy Act (FERPA) violation, or it could not be, depending on whether the information is shared alongside answers or grading metrics. Traditional DLP tools can’t distinguish that difference.

AI also further complicates the situation. Most people across universities are already using AI tools, with users pasting sensitive information into prompts, generating outputs that no longer carry classification labels and potentially accessing those materials later from personal devices or accounts. 

That means security teams are bombarded by high volumes of alerts, leading to long and tedious investigations that usually end with false positives. While analysts spend valuable time chasing nonsense, genuine threats become harder to identify and easier to miss. 

Balancing Protection with Academic Openness 

In the university context, effective data protection programs know the difference between when to investigate, when to educate, when to intervene and when to block certain actions. The context behind the data becomes the key. 

Let’s look at our previous example of a faculty member from University A sharing large amounts of research with people outside the institution. If that professor is collaborating with external researchers, they may be conducting legitimate academic work. However, if that same activity involves unusual recipients, unexpected destinations or information that falls outside of the normal scope of collaboration, it becomes a different conversation. 

The actions look identical, but the context changes everything. Understanding the intent behind data movement is just as important as understanding the data itself. 

This is why university security teams should focus on solutions and a robust data protection strategy that prioritizes high-risk activity versus low-risk policy violations. Not every alert represents a meaningful security risk. 

Modern, AI-native DLP tools that align controls with how faculty, staff and students usually work can reduce alert fatigue and free up security teams to focus on the real threats that matter. This approach can build trust between security teams and academic stakeholders by ensuring that data protection fosters and protects collaboration rather than hinders it. 

Security That Supports The University Model 

Imagine if Socrates’ students were forced to stifle any questions on prevailing ideas, or if John Dewey’s educational theories had never extended beyond the walls of a single classroom for fear it might be shared with the wrong audience. Universities thrive because their data can move. If data protection strategies and tools don’t evolve to support those initiatives and provide context, their teams will be left fighting the very openness that makes them successful. The future of higher education cybersecurity depends on innovation and security peacefully coexisting.