SonicWall has released its 2026 Education Protect Brief, highlighting the growing cybersecurity risks faced by schools, colleges and universities. The report found that education recorded the highest per-device attack intensity among all tracked industries in the first half of 2026.
Education networks recorded 81,879 IPS hits per device, while malware activity reached 16,242 hits per device. SIPVicious VoIP exploitation accounted for more than half of all intrusion prevention events, generating 90 million combined hits.
The report also found that a 2021 Hikvision IP camera vulnerability was detected on 605 devices across 28% of education networks. Apache Log4j2 generated 6.7 million hits, while 44 education organisations detected active ransomware campaigns during the period.
“Education has the most exposed attack surface of any industry we track, and the data shows attackers know it,” said Michael Crean, SonicWall SVP of Managed Services. “Education endpoints endure the heaviest per-device attack pressure in our entire dataset. Unlocked network doors remain the operating reality, and threat actors are actively taking advantage.”
Crean added, “Half of all attacks against education are going after one thing, and it isn’t the thing most districts are budgeting to defend. Firewalls are essential perimeter security, but they can’t defend what they aren’t configured to inspect. Leaving legacy SIP endpoints unhardened inside the network negates the investment at the perimeter.”
The report recommends Zero Trust security to help education institutions continuously verify users and limit access to critical systems.
“The highest per-device attack intensity of any vertical we track requires a security model built for it, not a patched-together version of what worked for a smaller, less open network,” said Crean. “Education doesn’t need to close its doors to be secure. It needs to know who’s walking through them.”
