Education
Education Runs on Open Networks. The Data Isn’t Open.
Departments, labs, student societies and campus services each run their own sites, so no central inventory is ever complete. Behind that open surface sit student records, research data, health systems and payment pages.
The Deepinfo Platform finds what the institution exposes, scans it continuously and watches for institutional accounts in leaked data and lookalikes aimed at applicants and donors.
- Asset discovery: inside the gate, a robotics lab’s own prefab cabin, outside central IT: uni-robotics.example, not in inventory.
- Continuous scanning: on the health centre’s roof, a unit that was not there at the last scan: health.uni.example, 8443/tcp newly open, high, caught between two scans.
- Risk detection: the fee office’s window in the university hall, the payment page: pay.uni.example, certificate expired, high.
- Risk scoring: behind a faculty’s window, its departmental server: physics.uni.example runs Apache httpd 2.4.49: CVE-2021-41773, CVSS 9.8, listed in CISA KEV, critical.
- Cyber Threat Intelligence: past the campus, a third-party service that was breached, holding an institutional address (masked): s.•••@uni.example, in breach data.
- Brand Risk Protection: outside the gate, under a copy of the university hall’s dome, a banner that is not yours: uni-admissions.example, lookalike · contains.
- Third-Party Risk Management: past the campus’s last pier, a learning platform’s offices and a hosting provider’s hall, drawn dashed because they are not yours: lms-vendor.example, graded C; cloud-hosting.example, graded A, each linked to uni.example.
An Open Campus Holds Sensitive Data.
Decentralized IT
Many Owners, One Name
Departments, labs and student societies register domains and run systems without going through central IT.
Research
Data Worth Stealing
Research in technology, life sciences and defense-adjacent fields draws the interest of state-sponsored actors.
Accounts
Addresses Everywhere
Staff and student addresses sign up to many third-party services, and those services get breached.
Seasons
Phishing on a Calendar
Admission, scholarship, fee-payment and donation cycles each bring lookalike pages aimed at applicants and donors.
From One Domain to Every Department.
On a campus, the work starts with the gap between the inventory and the internet. Discovery closes it from the outside.
-
01
Seed
Add the institution’s primary domains. Each one becomes a starting point.
-
02
Expand
Asset Discovery enumerates subdomains and their IP addresses, then runs reverse lookups against the index to find departmental and project domains registered separately.
-
03
Review
Your team approves what belongs to the institution and ignores the rest. Any decision can be reverted later.
-
04
Monitor
Approved assets are scanned continuously from then on. A faculty or affiliated entity can run as its own portfolio.
Institutional Accounts in Leaked Data.
Employee Email Breach Monitoring lists the institutional addresses found in known breaches and the data types each breach exposed. Compromised Employee Device Monitoring finds infostealer infections on the machines that hold institutional logins.
Your team works each record to a recorded state, and a notification rule can flag new breaches as they are detected.
- Passwords breach
- Phone numbers breach
- Names, Job titles breach
- new breach, raises new_email_breach_detected
first → last breach date
- Passwords
- Phone numbers
- Names
- Job titles
- Per address
- Breaches it appears in, data types exposed
- Per device
- Password and cookie counts, same-password rate
- Notification
- New email breach detected
- Report
- CTI Email Breach Summary
What the Platform Maps on Campus.
Issues are classified against the mapped frameworks as they are raised. Education-specific rules sit alongside as context.
| HIPAA | Mapped (hipaa). Campus health services. |
|---|---|
| PCI DSS 4.0 and 3.2 | Mapped. Tuition, fee and donation payment pages. |
| OWASP Top 10 (2021), CWE | Mapped. Student portals and departmental web applications. |
| FERPA | Context only. Applies to US student records. |
| GDPR, KVKK | Context only. Personal data rules, not platform classifications. |
What Campus Security Teams Use It For.
Attack Surface Management
One inventory across faculties, labs, societies and campus services.
Subsidiary Oversight
Faculties, institutes and affiliated entities as portfolios, compared on one scale.
Credential Exposure Management
Staff and student credentials in breach data and infostealer logs.
Phishing Detection and Prevention
Lookalike admission, fee and donation domains caught when they first appear.
Vulnerability Management
CVEs on departmental servers ranked by CVSS, EPSS and CISA KEV.
Data Leak Detection
Your institution and its domains named on forums, markets and leak sites.
Dark Web Monitoring
Search and watch the dark web for your names, domains and addresses.
Compliance and Audit Readiness
HIPAA and PCI DSS findings classified as they are raised, with their history.
The Data Is Yours to Use Too
The index under the platform is also sold as data. Teams that build their own tooling query it through the API or take it as bulk feeds, and Internet Insights shows what it sees each day.
Questions About Deepinfo in Education
Can the platform find sites departments set up on their own?
That is what discovery is for. Starting from your primary domains, Asset Discovery finds subdomains, the IP addresses behind them and related domains through shared registrants, mail servers and name servers. Your team decides what belongs.
We have a small security team. Is continuous monitoring realistic?
Scanning and discovery run on their own once assets are approved. Vulnerabilities are ranked with CVSS, EPSS and CISA KEV, and notifications can arrive as a daily or weekly digest instead of one by one.
Are student addresses covered?
Breach monitoring follows the addresses on the email domains in your scope, so student addresses are covered where students use an institutional domain.
Can the platform find fake admission or donation pages?
Brand Risk Protection matches newly seen domains against your institution’s names, down to letters from other alphabets, and watches each one your team approves across DNS, mail, certificate and HTTP. Confirmed ones can go to Managed Takedown.
Is FERPA mapped?
No. FERPA is not a platform classification. HIPAA and PCI DSS are, which covers campus health services and payment pages, and issue history and reports give your auditors evidence for the rest.
Is there access for academic research?
Qualifying researchers can apply to the Researcher Program for access to the dataset. Tell us what you are studying and which parts of the data you need.
See Your Campus From the Outside.
Book a demo that starts from your institutional domains.