Two education stories landed in the same week. A British Columbia school district confirmed it is dealing with the fallout of a ransomware incident, in reporting rounded up on Oct. 26. Days earlier, Herzing College's Toronto campus was approved to offer a Bachelor of Applied Cybersecurity — a sign of how badly the country needs people who defend systems for a living.
Between those two stories sits the daily reality of institutional IT: thousands of student and staff devices, bought in waves, aging at different speeds, patched when someone finds the time, and supported by a team small enough to fit in one classroom. Attackers do not need the fleet to be weak everywhere. One forgotten corner is enough.
The defence is mostly housekeeping, done relentlessly: knowing every device you own, replacing the ones that can no longer be secured, patching on a rhythm instead of a panic, and making sure a reset request at the help desk follows a procedure — the same help-desk discipline Canada's cyber centre warned about this week.
An institution's security is not set by its best-protected system. It is set by the oldest laptop nobody remembered to retire.
That housekeeping is a service, not a purchase: inventory, refresh cycles, patching and support run as a standing device lifecycle and refresh program with managed support behind it, sized for teams that were never given a fleet department.
This term, ask your IT team three questions: how many devices are past their secure life, what is the patch rhythm, and who answers when something looks wrong at 9 p.m. If any answer is a shrug, that is your plan for the year — written by default.