Several years ago, as a CIO, I, Suren Govender, experienced first-hand what happens when a major cyberattack moves from the technology environment into the operating heart of an organisation. What became clear very quickly was that a cyber incident is not only a technical event. It is an organisational stress test. It tests leadership, decision-making, communication, operational continuity, supplier dependency, data confidence and the ability to recover critical services under pressure.
In the middle of a crisis, the questions become very practical:
- What must keep running?
- Which systems matter most?
- Who has authority to decide?
- What can be restored safely?
- What evidence can leadership rely on?
- How and what do you communicate when the facts are still emerging?
That experience shaped my view of cyber resilience. Security tools matter, but they are not enough. Resilience is built through visibility, architecture, governance, recovery capability and disciplined execution. Most importantly, resilience must be designed before the crisis, not improvised during one.
My personal lesson is highly relevant to higher education. Universities are no longer only physical campuses supported by technology. They are digital trust platforms responsible for learning, research, identity, collaboration, finance, student services, intellectual property and reputation. A disruption to identity, email, registration, learning platforms, research systems, finance, residences, library services or examination processes is not simply a technology outage. It can become an academic continuity issue, a research risk, a student trust issue and a reputational event.
This challenge is amplified where leadership continuity is uneven, key roles are vacant or decision-making authority is fragmented. In such environments, resilience cannot depend on heroic individuals; it must be built into the operating model. For universities, that means three practical moves.
- Secure what matters: protect critical services, identity, data, privileged access, backups and incident response.
- Modernise what constrains: decouple legacy, reduce dependency and create a platform layer that can orchestrate experience, data and process.
- Transform what creates value: build reusable institutional capabilities for student services, research collaboration, workflow automation, AI and cyber resilience.
AI makes this sequence more important, not less, because AI is not the strategy; it is the accelerator. Weak foundations amplify risk, while strong platforms amplify value. The future university will not be the one with the most systems. It will be the one secure enough to trust, controlled enough to adapt and modern enough to move.
As a practical next step, iGuardSA is offering HEITSA member institutions a no-cost cybersecurity posture assessment. The assessment is designed to provide a high-level view of current cyber exposure, resilience gaps and priority areas for improvement, helping institutions understand where to secure what matters, modernise what constrains and strengthen their readiness for digital transformation. Contact us on 01010 CYBER (29237) or info@iguardsa.net