SonicWall finds education faces highest per

Schools and universities recorded 81,879 intrusion prevention hits per device during the first half of 2026, with researchers warning that open education networks are creating opportunities for attackers.

Education experienced the highest per-device cyberattack intensity of any industry tracked by SonicWall during the first half of 2026, according to new research highlighting the security challenges facing schools and universities.

The 2026 Education Protect Brief found that education environments recorded 81,879 intrusion prevention system (IPS) hits per device during the six-month period.

SonicWall attributed much of the exposure to the structure of education networks, which frequently need to accommodate student-owned devices, faculty research systems, public-facing services, third-party learning platforms and administrative databases.

Michael Crean, SVP of Managed Services at SonicWall, said: “Education has the most exposed attack surface of any industry we track, and the data shows attackers know it.”

He added: “Education endpoints endure the heaviest per-device attack pressure in our entire dataset. Unlocked network doors remain the operating reality, and threat actors are actively taking advantage.”

One of the biggest sources of activity involved Voice over Internet Protocol (VoIP) infrastructure. SIPVicious exploitation generated 90 million combined hits and accounted for 50.5% of all IPS events recorded across the education sector.

Malware also remained a significant concern, with education recording 16,242 malware hits per device – nearly 3.5 times the rate observed in retail.

Researchers also identified evidence of attacks targeting older vulnerabilities. A command injection vulnerability affecting Hikvision IP cameras, first disclosed in 2021, was detected on 605 devices across 28% of education networks in SonicWall’s dataset.

Apache Log4j2 generated a further 6.7 million hits, indicating that vulnerable software remains present within some learning management and administrative environments.

Ransomware also continues to pose a threat. SonicWall said 44 education organisations detected active ransomware campaigns during the first half of 2026, including activity involving the Ryuk ransomware family.

The findings come as educational institutions continue to balance cybersecurity requirements with the comparatively open networks required to support students, staff, research and digital learning

A Intelligent Global Media Brand