Lessons on Cybersecurity Awareness and Cyber Incident Response

Sophie White: Hey everyone. This EDUCAUSE Shop Talk episode caps off 2026 Cybersecurity Awareness Month. And in it, Isaac Galvan and I talk with Kelly Crisp and Mat Flower about what cybersecurity and privacy awareness means for higher education. We also take some time to discuss a major cyber incident that Mat experienced on his campus a few years ago and what he learned from that in terms of the human impact of a cyberattack. And we also talked about where the field of cybersecurity and privacy awareness may be going, especially as a result of agentic AI, some of the changes in how we work with solution providers and their access to our data and technology and what as higher ed institutions we should be thinking about in terms of supporting education of faculty, staff, and students so that they are more cyber aware after they leave our institutions. Hope you enjoy.

***

Sophie White: Hello everyone and welcome to EDUCAUSE Shop Talk. I'm Sophie White, a senior manager of program and content marketing here at EDUCAUSE, and I am one of your hosts for today's discussion.

Isaac Galvan: And I'm Isaac Galvin, the community program director for cybersecurity and privacy with EDUCAUSE, and I'll be your co-host today.

Sophie White: And we're so excited to have two special guests with us here today to talk about cybersecurity awareness in higher education as well as some lessons from a cyber incident. So I'll introduce them and then we will jump into it. First of all, we have Mat Flower. Mat is the assistant director at the University of Wolverhampton in the UK and has a career working with technology spanning almost thirty years. In 2024, Mat received the phone call that nobody wants to hear informing him that his institution was suffering a major cyber incident. Despite being perhaps the darkest and most challenging of times, it also provided some of the most valuable and rewarding of experiences. Mat is also a trustee of UCISA, EDUCAUSE's equivalent in the UK. When he's not thinking about technology and security, you'll find Mat squeezing in his daily workout, needing a fresh loaf or wrestling with German grammar one lesson at a time.

Sophie White: I love that bio, Mat. Are you learning on Duolingo or something or taking German lessons?

Mat Flower: I've tried different types of learning, but I found that actually just immersing and I've just come back from Berlin where I was able to put some of it to practice.

Sophie White: Good for you. I have not had much luck with German myself. I was in Berlin about a month before recording this and it's a struggle, but learning languages is so valuable and thank you for being here and also for being willing to share your lessons from the cyber incident that you mentioned in your bio. We'll get into that in a bit. Next up we have Kelly Crist. Kelly has led IT communications at New York University for seven years, helping students, faculty, researchers, and staff confidently leverage technology, embrace change and adopt best practices in cybersecurity and data privacy. She and her team create engaging relevant content across multiple channels, including a newsletter reaching approximately 86,000 people, a four-hundred-plus page website and digital signage. Kelly holds a law degree and a master's in strategic communications, is Prosci certified and brings a diverse professional background that includes working with distressed companies, contributing to the film industry and serving as a registered lobbyist.

Sophie White: Wow, Kelly, thank you for being with us and your suite of experiences is so impressive. How do you find the time for all of it?

Kelly Crisp: I wonder that myself.

Sophie White: That is amazing. Well, thank you both so much for being with us. And so we'll jump into it. We're recording this in October 2026, and I'd love to just kick off a bit with the cybersecurity awareness discussion. I always think that cybersecurity awareness from my maybe less technical background is really interesting because it has obviously the technical perspective. We need people to understand the threats that are out there, the risks, but it also has such a stakeholder management, communications, marketing, PR element to it that I think is really challenging, especially now with how much information we're being inundated with. So I'm curious, why do you all think that this is such an important field now and how have you seen this field changing during your times in cybersecurity and privacy communications? And whoever wants to kick that off first. Kelly, I'd love to hear from you because I know you've been doing this kind of work for a while.

Sophie White: So I'm curious, what do you think about this field and then maybe how can we help people adopt some of these behaviors that reduce the risk before we have the incidents?

Kelly Crisp: Sure. Thanks, Sophie. So I think it is changing daily. We all feel it. The number of phishing attempts, cyberattacks, and the complications involving AI and AI agents are making this particular field very, very, very difficult to navigate. I think we have to be aware of the threats out there, but we also need to understand how can we make it easier for our audience, students, faculty, staff, and researchers to understand not only what to do, but when to do it and why it makes sense to do it. I think that's one of the biggest challenges is we have very smart people in our world, in our community. So I think many of them, most of them know not to share their password. They know to make sure they have VPN on when they're working with sensitive data. But sometimes maybe we also create a safe environment for them and they believe they're safe when they're actually working in higher ed.

Kelly Crisp: And higher ed is actually one of the most targeted fields because we have everything. We have PII, the personal information, we've got financial data, health records and research. Research is very valuable. And so yeah, I think that it's becoming more complicated, but we're up to the challenge always.

Isaac Galvan: Kelly, there was something in your bio that really stood out to me and it said helping them be confident, confidently leverage technology. Now you mentioned some of these are very well-accomplished folks, but what's one of those scenarios where that boost of confidence could be helpful, that might be something that people do every day in technology, but certainly could be nerve wracking. You think of something?

Kelly Crisp: Sure. I think that being confident about where to go for help, it's so simple. Sometimes we overcomplicate how we think about driving awareness and changing behavior. Simple, make it simple. And so where to go for help, how to report phishing incidents, feeling confident that you can do so without being judged. We want people to raise their hand and say, "I need help. I don't understand. Something happened," and let the experts that are trained to help them. So I think sometimes we overcomplicate it and it's really very basic. We have a new initiative that I can talk about later called Buying Tech. It's actually not a new initiative, but we're driving more awareness to it and really creating an environment where our technology can be vetted for cybersecurity, data privacy, accessibility, all the things, and user experience before we allow it into our ecosystem.

Mat Flower: Following on from what Kelly said, what I've seen at my institution and across the UK, as part of that awareness, you need to develop... It's a two-pronged approach. It's both digital confidence and digital competence. Kelly, you said we've got really smart people in our institutions in their respective field. We need to make sure that they are confident in using the digital services, the tools that we give them, but also with that level of competency to make sure that they are using them in the right way, that they're not exposing either themselves or our services, our data to any risk. Because if you've got somebody who is really digitally confident, but is lacking that awareness around good cyber, the risk increases exponentially. So it's making sure that we're providing them with and equipping them with both sets of skills.

Kelly Crisp: That's 100 percent, 100 percent, Mat. And in fact, tagging onto that, not making assumptions about what they know and they don't know. That was one of the learnings that we had a few years ago is that we have all of these digitally native students coming into our community and we're assuming that they understand how to get on WiFi. It's been very intuitive for them because they're at home, they're on their phones, they're on their computers, WiFi just appears magically. They're at school, at high school, same thing, magic. It's all magic. And so not making assumptions. And we've shared surveys about cybersecurity and cybersecurity awareness and gathering that information, asking those specific communities not only what they're interested in, but what their needs are. Testing also. We have a survey that goes out to students that are onboarding, that are coming into the university and we test them, not test them, we ask them a question about their MFA, and the survey allows for answers to appear based on their response.

Kelly Crisp: So if we ask them, "Are you on MFA? What is MFA?" It goes to a particular document, "I think I am, but I need to get on MFA on my phone," or whatever it is. And so having that information, relevant information on the channels that they're already on, partnering with other departments and units across our community has been really helpful. Even making sure that they have an email address that's not their high school email address as their backup email address, testing them, basically giving them that, "Are you sure?" Because at some point they're not going to be able to use their high school email address, and it seems like such a simple thing, but it's not top of mind for them. And so not only reminding them, but giving them that relevant information at that particular moment in time has been helpful to us.

Isaac Galvan: I love that you said confidence and competence. And so I understand that there is a knowledge aspect to understanding how to stay secure online. Some of us in the cybersecurity world, we live in a world of IT security controls and standards, and we're very familiar with everything on the back and the front end that goes into protecting data. But for a member of your community, you don't expect them to read the IT standards document or the IT controls documents. How do you make that more accessible for them so that they have that competence of what's understood for their role?

Mat Flower: That's a really good question. Awareness is a really big part of how we protect our user community, our university community, and our infrastructure and our services. But how we designed those security controls is equally important. And what we strive to do at UOW is to remove the friction. As soon as you put what a user might deem as an unnecessary hurdle in the way, which is delaying them doing what they want to do, they're clever people. They'll try and find a way around it. So as well as the awareness and making sure that they understand why there are controls and protections such as MFA in place, make it as frictionless as possible. There are some things that we can't make completely transparent and need some user engagement in process, but make as many of those protections invisible to the user and transparent to the user so it doesn't get in the way, but it's providing them with those relevant controls as much as you're able to.

Mat Flower: So secure by design, but design with the user absolutely at the center of your thinking.

Kelly Crisp: Yeah. The relevant information, Isaac, is I think so fundamental to how you influence behavior. Should I pay attention to this? Is this for me? We've designed checklists for a general population, for IT professionals, for researchers, and even for parents. Parents are often kind of that tier one. I know I've gotten calls at midnight, I can't upload my paper help. And so sharing that information routinely, not only at the start of the school semester, but throughout the year, cybersecurity is not just a one and done in October, but throughout the year, and it's really relevant information for them so they don't have to scan for what's relevant. It's all relevant.

Sophie White: Thank you for that, Kelly. And I think it's important to think about our role as higher ed and how the world functions as a whole. We've got these students who are on our campuses for a certain amount of time, but they also influence their parents and community members and future jobs, and it's a really important thing for us to be training them in these future community and workforce skills that will support their lives outside of college too. So I'd love to turn a little bit, Mat, you mentioned how we can create security by design maybe in the backend while we're also talking about communicating with folks about secure practices. Kelly, you mentioned you have a program at NYU where you are looking at solutions that you're procuring and I think doing some work on your side to make sure that you're setting the students, faculty, staff up for a secure ecosystem.

Sophie White: Can you talk a bit about what that program looks like and maybe some things that other institutions could take from it?

Kelly Crisp: Sure. So we care very much, like Mat said, about not only the user experience, but having tools available, easy to access, but also safe. And so with BioNTech, there are three paths basically, you could say two, but one is preferred solutions. These are the solutions that we provide support for. Obviously, they're vetted, they're managed by NYU. The next is vetted solutions. So those are solutions that we have vetted software, et cetera, that we've vetted for particular use, but you have to pay attention to that use case. So if you're using MailChimp or some sort of enterprise email system to send personal data, no, that's not a thing. You can't do that. And then the next path is something that is outside of those two that goes through a very rigorous process where we bring in the cybersecurity team, accessibility, data privacy, et cetera, to make sure that everything at NYU is safe, it's easy to access, it's easy to use, it's relevant to their experience, and it also provides a cost saving measure.

Kelly Crisp: So if folks are using one particular platform, we may invest in an enterprise solution. And so the preferreds are enterprise solutions vetted are a little bit distinct, and I think it's a great initiative.

Kelly Crisp: I think it's going to be a very healthy way to move forward, particularly when things are changing so much, AI in particular, but other ways to protect us and the people who have a need, our faculty, students, staff, researchers, et cetera, they're not necessarily experts in cybersecurity. They're not necessarily looking to make sure that a particular platform checks all the boxes, and they would not want to use something that could put NYU at risk. So this is a win-win for everyone, I believe.

Sophie White: I appreciate that, Kelly. It sounds like your thoughtful strategic approach to this. I'll also mention at EDUCAUSE, we have the HECVAT, which is a great tool, higher ed community vendor assessment toolkit. Is that it? Okay. I think I've got the acronym now to help. It's a community-built tool to help institutions as they're looking at procurement to check cybersecurity, privacy considerations. Considering the quickly changing nature of all of these issues, I'm always shocked every time I do a cybersecurity training by how fast, especially with the advent of AI, things are changing. Our annual conference earlier this fall, folks were starting to talk about quantum and what that might look like for cybersecurity down the road in a few years. So I think that it's important to keep up with all these changing trends, and I'm curious, Mat, you've alluded to this a few times. I think your bio had a really great introduction to your cyber incident.

Sophie White: Do you want to talk a bit about that and maybe some lessons that you've learned about cybersecurity awareness, how you work with institutions, students, faculty, staff as a result of it?

Mat Flower: Sure. Whilst our incident took place back in early 2024, it's as fresh in my memory as if it happened last month. You referred to it in my bio, Sophie. I'd been at work on, I remember the date exactly, Monday the 19th of February, done a normal day, and I was at home 9:00 PM in the evening, and I got a call from our SOC and they said, "We're seeing some abnormal behavior on your estate. We're going to continue to investigate, but you need to be aware." I got in touch with one of my team who, like a lot of institutions in the UK, while we provide services that are available 24/7, we don't have the resources to support them twenty four seven. So I was fortunate that my team member responded to the SMS message, and I though, "Oh, okay." I though, "This is a desktop exercise because our operator had been talking about it." And I though, okay, they've scheduled it for 9:00 PM at night, so it's kind of realistic, but not too inconvenient.

Mat Flower: So I though, I'll play along.

Mat Flower: I got another call from the SOC. I got another call from my team member and realized that it was real, and it was probably as bad as it could get. By about 10:30 that evening, I had a small team back on campus, and I'm not ashamed to say they were my brightest and best people, which given the nature of the incident, we worked through the night, we disconnected the institution from the internet, which was both a really big decision, but I have to say really quite underwhelming because if it had been portrayed in film, you'd pull the cable, the lights probably would've gone dark and lighting came on. It was all very anticlimactic, but we worked through the night after, I think by 4:00 PM the following day, I was sending people home because I thought my team were almost dead on their feet.

Mat Flower: Thirty-six hours after I'd got up the night before, the day before, I was home, a few hours sleep, and then rinse and repeat thirty-six days to recovery. It was without doubt the most challenging time in my career to date, and I genuinely hope I'll never experience anything like that again. But I had sat through presentations and desktop exercises of this is what happens when you get the call. One thing those things just absolutely cannot prepare you for is almost the impact it has on you as a person and your team, the physiological impact. There were a few times where I took myself off to a dark corner and literally just sat there with my head in my hands thinking, "I don't know how I'm going to get us out of this." But I was really fortunate to have some amazing colleagues around me who gave me either the kick or the supportive words to say, "Look, you've got this, we will get through it." And I learned so much about myself in terms of my resilience, and I think until the point comes when I retire, I will be so proud of my team who everything that they did to help me and the university get out of the worst of problems.

Isaac Galvan: Ed, it sounds like you had a little bit of trial by fire there and learned a lot about yourself and your group's capabilities there during the incident. If you had to run through again a similar thing, even in a rehearsal kind of scenario, what kind of skill or capability do you wish you guys had ahead of time now in retrospect? Is there something that, a bit of visibility or a process that you wish you had in place, maybe a stakeholder you wish you would've brought in earlier that now you know that might have helped you in your next incident because we all know those are not impossible to have an issue like that again.

Mat Flower: I've spent probably more time that is healthy since that incident replaying the decisions that I took and when I took them, "Should I have done this? Should I have done that? Should I have disconnected from the internet sooner?" And then as quickly as I start to do that, I kind of check myself and say, "Look, you can't change what has happened, but what I have done is take as many learnings from that. So as part of the recovery, we didn't build back as is. We took every opportunity to build back in a more secure, more robust fashion because to rebuild as it was, you're potentially leaving those gaps in your defenses still open.

Mat Flower: I was really fortunate that the wider university community were super supportive because we have a process called Gold Command for major incidents, and that process was spun up during the night that the incident broke. And we had the first call at right about 6:00 AM, so that would've been all of the university's executive leadership deans and directors from across the business. And I went into that call, hotspotted off my mobile because we had no network connectivity, really expecting to be given a tough time, but they couldn't have been more supportive. And that continued throughout to a point where one of the things that I was able to procure and roll out, one of the leading MDR, XDR security solutions across the estate. And under normal circumstances, getting the funding for that would've taken months. So the fact that I was able to use that opportunity to get that in such a short period of time helped me sleep better at night once we'd rolled it out.

Sophie White: Mat, thank you so much for sharing that, and I'm sorry for everything you went through during that period. It sounds truly like a stressful and life-changing moment in your career, so thank you for being willing to share it with us. I'm curious, thinking about cybersecurity awareness generally as an industry, you mentioned that the larger community helped you. How do you think we can all work together as higher ed cybersecurity practitioners to maybe spread awareness about emerging threats, share the lessons that you have from incidents like that? Do you think there are ways that we can all better work together to try to prevent issues like this in the future or share awareness about what we should be considering as institutions in this day and age?

Mat Flower: Absolutely. For what was probably the longest time, I always thought it was a case of not if, but when we would get hit. But when I look at the higher education sector in the UK, I somewhat naively thought there's richer targets than my institution, but I was proved wrong. Early on in our recovery, I found it increasingly difficult to manage the expectations of senior leadership in terms of how long the recovery would take because we'd never been through this sort of thing. And whilst I could give an estimate of time for a particular service, how long it would take to bring everything back was a bit of an unknown. So I was really fortunate to... I've got a network of colleagues across the sector, some of which had been through similar instance. And one colleague based in the northeast of England offered to join one of our gold command calls to share their experiences, which proved invaluable because hearing it from a third party brought to life what we were going through in terms of the recovery.

Mat Flower: What that kind of then instilled in me was I want to pay that favor back to my own sector in any way possible because if I can share the experiences of what we went through at my university, if that helps prevent something happening to another colleague, that's just the best thing in the world. Or at the very least, if they do find themselves getting that call, if there's anything that they've been able to learn from our experiences that helps them get through it, that's just as good. And I've been honored, in a real honor, that I've been contacted by lots of other universities asking me to either share the story of what we went through, my insights, advice, and then that will ripple out. I think that they will then share that within their own institutions and hopefully develop this culture of sharing. It doesn't just have to be talking about the implementation of a new student record system that's gone really well.

Mat Flower: Across the UK, we will share the war stories even if... For sure, there's lots of lessons that we've learned from our experiences. If that can benefit the wider sector, that gives me a really warm, fuzzy feeling inside if I want.

Isaac Galvan: Yeah, I'm so glad you mentioned that, Mat, and sharing with the community here is I think really a strength of working in the higher education sector. It's something that we do so well is information sharing and sharing process and lessons learned and things follow up from incidents. I love that about working in higher ed. So if anybody's on the outside looking in is not currently in higher ed, that's the environment you're looking to join if you were to come over to our sector. I also wanted to touch on, you mentioned the bigger fish, they're looking for bigger fish. Well, I think bad actors are very opportunistic, and so if they find an in, they're going to exploit it. So they don't really care about the size of the fish in a lot of cases. Certainly that does Mater for reasons that I won't get into to them, but small fish are just as valid as big fish in their world.

Isaac Galvan: But I did also want to mention that at least in the US, and I believe the UK probably reflects this, education is actually the highest targeted sector in terms of cybersecurity bad actors. And I think that's something I hope our communities understand and are taking to heart. So Kelly, do you get the feeling that people on your campus really understand that education right now is the highest targeted sector with these bad actors and are acting appropriately?

Kelly Crisp: That's a great question. We've surveyed that before a few years ago and it wasn't as high as we had hoped it would be, but it's that balance. So when you come to a university, an educational environment, we spend a lot of time talking about being safe, safe in a lot of different ways. So that message of being safe, you can be safe to show up as who you are, you can be safe to et cetera, et cetera, because it is kind of the quintessential sphere, protected sphere. So the messages around cybersecurity really also need to honor that and understand that we don't want to create fear because people turn away the science of influencing behavior, the neuroscience, if you make cybersecurity so scary and you don't give them tools that they feel confident using readily, they will just ignore the messages. I mean, that's your brain paying attention to things that matter.

Kelly Crisp: They avoid safety when they can't do anything about it. So we've got to really make sure that the content is relevant, that it creates a feeling of safety while giving them the messages that will help them protect not only their own data, but the university's data. I do remember one outcome of that survey is we tested, do people in our university protect data because they want to protect themselves or do they protect data because they want to protect their peers? And so I love that question because the answer enables me to create messaging to respond to those perspectives. And it was fifty fifty split. So not forgetting the fact that people really will, maybe they don't feel like they have data that needs to be protected, like the proverbial, I'm just a kid, please take my bank account, I have nothing in it. Not a good thing, but really making sure that we also respond to, there's a lot of sensitive information that could impact not only the brand, but your colleagues, et cetera, steal research and that has ripple effects and it impacts directly that researcher that spent a life working on it.

Sophie White: That makes me think of a question. With agentic AI, I've been seeing that Meta just released a new agent and thinking about the student who might say, "I have nothing in my bank account, why do they care about my data?" Are you all doing any education around privacy as it relates to AI agents? This feels like a really important thing for institutions to do in my opinion of no, this is why giving all of your data to an agent may be a scary and not so smart thing to do. How do you all respond to that question?

Mat Flower: I think for us, it's a very real life challenge right now because when it comes to cyber generally, we're always playing catch up because the threat actors are always one or two steps ahead. When it comes to AI and the risks that that poses, they're almost over the horizon in terms and preparing our institutions. The tools now are easily consumable. So there's no friction, there's no hurdles in terms of accessing them. And the benefits of using them are very real and tangible. I use different tools multiple times throughout the course of my day and it makes me more productive. But given my background, I do so with a relevant degree of caution. But it's kind of touching on what we were talking about earlier about digital confidence and digital competence. You might be confident in using any of those models, any of those tools, but you need to be competent enough to be using them in the right way.

Mat Flower: And we have a responsibility to educate, to guide where we can, put some technical controls in place, guardrails if you like, to make sure that people aren't either exposing themselves or the university to any degree of risk. But we're definitely playing catch up at the moment, and I don't believe that my institution in the unique in that position.

Kelly Crisp: Yes, I think we're educating particularly students. Students are our largest audience, but they're honestly not our most important audience. The most important audience are the people with keys to the kingdom, as I say, is our technologists, the people that have access to highly sensitive data. But we do have a responsibility, I think, to educate students so that they practice good cybersecurity hygiene. They use the best practices that they've learned at our institution at NYU to have a better day every day, have a better future, not be the person at their first company that reuses a password and has now jeopardized data. We do focus on cybersecurity year round. So we have a campaign in October that's pretty epic, I think. But cybersecurity is every day and it just needs to be woven into the fabric of how we show up as critical as breathing cybersecurity is.

Kelly Crisp: So we talk about paying attention to what you share online, that's a big deal, paying attention to certain platforms, et cetera. So yes, we do a considerable amount of outreach to students in particular, but we also pay attention to the folks that really Mater. Keys to the kingdom.

Sophie White: Isaac, I know you've done a lot with risk assessment in your time in higher ed, so that to me makes me think we do have to communicate to these different stakeholders, but understanding the level of risk and access that they have is a super important consideration. So we're getting towards the end of our time. It's flying by. I'm curious, just as a closing question for you all, we're wrapping up Cybersecurity Awareness Month in 2026. What do you think institutions should be focusing on next as we look at this current landscape of higher education and cybersecurity and privacy awareness? Is there something we're not thinking about right now that we should be or any advice you have for other institutions who might be trying to plan out what's next for them?

Mat Flower: Isaac, you mentioned earlier about how HE is one of the, if not the most targeted sectors. I think something that organizations really need to start to understand much more clearly is it's not just our own institutions that are going to be subject to attack and at risk, it's the broader ed tech ecosystem. We've become increasingly reliant on cloud services provided by companies such as Instructure. We're a canvas house, so we were impacted. So it's not just our own institutions that are at risk. We have to be extremely mindful of our broader systems landscape that sit outside of our perimeter and what that would actually mean should those platforms not become available in terms of how our universities can support teaching and learning and the work of our professional services department.

Kelly Crisp: Yeah, I think we will be focused on AI in particular, so AI agents and really understanding what are we authorizing them to do. So I think that that is going to be incredibly important. I also echo Mat's comment about the vendors that we choose and making sure that we choose vendors that are safe and will continue to be safe, making sure those audits happen. I think that because responsibility for technology extends beyond our own systems. Our responsibility extends to all the systems and platforms that attach into our system. So we'll be working on incident communication and aligning across the university. I think that in universities, schools and units can tend to be siloed. And so making cybersecurity, taking it out of that siloed response and making it an enterprise endeavor, I think is going to be really, really important as well. So I could talk about this forever.

Isaac Galvan: I'd love to add my two cents here too. I think it's going to be really important in the coming year, even after Cybersecurity Awareness Month wraps up, to continue for all of our cybersecurity and privacy programs to continue to get to know the departments that they're working with and the roles that they're supporting to make sure that the tools and the processes and the standards that you're asking them to adhere to don't conflict with their work, don't make their life harder, but actually support their work. I love hearing things like secured up by design. Kelly, I loved hearing about your procurement easing. I mean, I think the grocery store I like is the one with the fewest selections. I don't need 32 different crackers to choose from. So if you have the ability for someone to easily select their hardware and make that purchase and do that securely and properly, that is the right path.

Isaac Galvan: So I'd love to see more programs continuing heading down that, making the secure choice the easy one.

Sophie White: Yeah, I think that's such an important point. Kind of going back to our first question, which was how do we make this topic feel important in a world where people are getting inundated with a lot of information? I appreciate your ending point, Isaac, about how to keep the user in mind as we're doing all of our cybersecurity and privacy awareness work. So thank you all so much for all of your fabulous insights today. I really appreciate how we were able to talk about the current landscape of this issue and Mat, also just the human impact of this work. I appreciate all you do, Mat, Kelly, Isaac, in this very complex ecosystem of cybersecurity that we find ourselves in higher ed. So thank you for all of your tireless effort to keep our campuses secure and thanks for joining the discussion today.

Kelly Crisp: Pleasure.

Mat Flower: Thank you.